Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3520

32
FAUCET Score

CVE-2021-3520 is a critical integer overflow vulnerability in the lz4 compression library, affecting products like NetApp, Oracle, and Splunk. An unauthenticated attacker can exploit this flaw remotely by submitting a specially crafted file, leading to an out-of-bounds write, system crash, and potential compromise of confidentiality and integrity. While rated with a CVSS score of 9.8 (Critical), there is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.8.3, < 1.9.4CPE matchmatch criteria
cpe:2.3:a:lz4_project:lz4:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
1.14.0CPE matchmatch criteria
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.19%
Probability of exploitation in next 30 days
EPSS Percentile
86.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0319 is in the 78th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

bitdefenderpatch availablevia llm_extracted
Fixed in: ['8.2.12', '9.0.6', '9.1.1']
View patch
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AMQ Streams 2.7.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: lz4-0:1.8.3-3.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-controller-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-log-reader-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-must-gather-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-operator-bundle:v1.4.6-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-registry-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-rsync-transfer-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-ui-rhel8:v1.4.6-4
View patch
redhatpatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8:v1.4.6-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-restic-restore-helper-rhel8:v1.4.6-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-rhel8:v1.4.6-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-velero-plugin-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: RHAF Camel-K 1.8Fixed in: lz4
View patch
redhatpatch availablevia redhat_api
Product: RHINT Camel-Q 2.7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-plugin-for-aws-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AMQ Streams 2.1.0Fixed in: lz4
View patch
zimbrapatch availablevia llm_extracted
Fixed in: 8.2.12, 9.0.6, 9.1.1
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: lz4
redhatno patchvia redhat_api
Product: Red Hat Integration Camel Quarkus 1Fixed in: lz4
redhatno patchvia redhat_api
Product: Red Hat build of QuarkusFixed in: lz4

Vendor Advisories (3)

zimbrallm-zimbra-9542faa91a6d6884HIGH

August Third Party Package Updates in Splunk Universal Forwarder

Aug 30, 2023
bitdefenderllm-bitdefender-2250a01bd7a7224eHIGH

August 2023 Third Party Package Updates in Splunk Enterprise

Aug 30, 2023
redhatCVE-2021-3520Moderate

lz4: memory corruption due to an integer overflow bug caused by memmove argument

Apr 28, 2021

References

bugzilla.redhat.com / show_bug.cgi
Issue TrackingPatchThird Party Advisory
security.netapp.com / advisory/ntap-20211104-0005
Third Party Advisory
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory
oracle.com / /security-alerts/cpujul2021.html
PatchThird Party Advisory
oracle.com / security-alerts/cpuoct2021.html
PatchThird Party Advisory