Read the docs
TI-2021-20927 Aliases CVE-2021-45918GHSA-qhhp-8cc7-vf7w

NHI’s health insurance web service component – Heap-based Buffer Overflow

Priority LOW 36CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remote attacker can exploit this vulnerability to flood the memory space reserved for the program, in order to terminate service without authentication, which requires a system restart to recover service.

Why it matters now

EPSS 0.01537 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NHIhealth insurance web service component515BE7DE5BCE446177FEE8A6E0665093—No fix listedCNA
NHIhealth insurance web service component42fcc36541e716e23de77d5f325b186a—No fix listedCNA
NHIhealth insurance web service component52EACB7CA2B4D0A5A869DF01079BF4D6—No fix listedCNA
NHIhealth insurance web service component52EACB7CA2B4D0A5A869DF01079BF4D6—No fix listedCNA
  • health insurance web service component VendorNHI Affected 515BE7DE5BCE446177FEE8A6E0665093 Fixed in — No fix listed CNA
  • health insurance web service component VendorNHI Affected 42fcc36541e716e23de77d5f325b186a Fixed in — No fix listed CNA
  • health insurance web service component VendorNHI Affected 52EACB7CA2B4D0A5A869DF01079BF4D6 Fixed in — No fix listed CNA
  • health insurance web service component VendorNHI Affected 52EACB7CA2B4D0A5A869DF01079BF4D6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nhi:health_insurance_web_service_component:-:*:*:*:*:*:*:*not specified by NVDVulnerableNHI
  • cpe:2.3:a:nhi:health_insurance_web_service_component:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NHI

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-45918
  2. 2026-10-03 Alias added: GHSA-qhhp-8cc7-vf7w

References

Advisory 1

  • TI-2022-15901 NHI card’s web service component - Stack-based Buffer Overflow-1 CVSS 3.1HIGH 7.8
  • TI-2022-15903 NHI card’s web service component - Stack-based Buffer Overflow-2 CVSS 3.1MEDIUM 5.5
  • TI-2022-15902 NHI card’s web service component - Heap-based Buffer Overflow CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences