CVE-2021-3749

highpriority · track · 43EPSS 0.085 · 95 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

8.52% (95th) EPSS

CVSS 7.8 · high

Is it mine?

28 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-22

axios is vulnerable to Inefficient Regular Expression Complexity

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedrhmtc/openshift-migration-ui-rhel8@sha256:19b8e2f0872faa1d1643d28aa3b893debfe22b102d049c02f335a622c29e3506_amd64 as a component of 8Base-RHMTC-1.6redhat_csaf
For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/4.8/migration_toolkit_for_containers/installing-mtc.html
https://access.redhat.com/errata/RHSA-2021:3694
FixedSINEC INSsiemens_psirt
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/
FixedSINEC INScisa_csaf_ot
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/
FixedPowerSYSTEM Centercisa_csaf_ot
For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center Client Access Server user's ability to access the browser's F12 Developer Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN, and to manipulate requests to the PowerSYSTEM Center website.
MitigationPowerSYSTEM Centercisa_csaf_ot
For all vulnerabilities, users can disable usage of previous UI extensions.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.8highAV:N/AC:L/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USexploitability 10 · impact 6.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security@huntr.devexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1333USCWE-1333USCWE-1333USCWE-400USCWE-400USCWE-400USCWE-400USCWE-400US

exploits (1)

Public proof-of-concept and weaponised exploit code.

T-Guerrero/axios-redosAxios Redos (CVE-2021-3749) proof of conceptPoC · poc_in_github

affected products (28)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat OpenShift Container Platform 4all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4
Subnet Solutions Inc. PowerSYSTEM Center: <=PSC_2020_v5.21.xall versionscisa_csaf_otUS
SUBNET Solutions Inc. PowerSYSTEM Center≤ PSC_2020_v5.21.xcisa_csaf_otUS
axios axios/axios≤ unspecified ≤0.21.1enisa_euvdEU
axios axios≤ 0.21.1nvdUScpe:2.3:a:axios:axios:*:*:*:*:*:*:*:*
oracle goldengate21.1 → 21.7.0.0.0nvdUScpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*
siemens sinec ins< 1.0nvdUScpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
siemens sinec ins= 1.0nvdUScpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
npm axios< 0.21.2osvUSpkg:npm/axios
rhmtc/openshift-migration-controller-rhel8@sha256:5dacb0bb125600adb6fecdc9ac583f38877960ae207cb21e925a1df4d36c9973_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS
rhmtc/openshift-migration-log-reader-rhel8@sha256:efca0066bcee905c93b907d30f5a5dac779b5fdab573eba2a6af738c275658ff_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS
rhmtc/openshift-migration-must-gather-rhel8@sha256:4ecda5f0f4ab61eb28d2b513cf373a18d7965acf2c3f81845fa6b9ace90cc1d0_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS
rhmtc/openshift-migration-operator-bundle@sha256:f3dfe6ccf078244debab1ae4571b20b7ecd884cd8d382a6dc10f4a479dce2c34_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS
rhmtc/openshift-migration-registry-rhel8@sha256:4603fc328b26a8dc454e1cb690f9d1b6534d2e51a806fc474158447fbe8fe6eb_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS
rhmtc/openshift-migration-rhel8-operator@sha256:5b1911b8e44a717866d7249abd966e487c6925e5eb77eaf507922866928badb6_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS
rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:3678c6f67225f0f37c022bc2604a6a5d78f15b7b57ba9073d06fa3466a3a0526_amd64 as a component of 8Base-RHMTC-1.6all versionsnot affectedredhat_csafUS

showing 20 of 28

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2021:3694Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.6.0 security & bugfix update2021-09-29csaf · redhat_csafUS
The Migration Toolkit for Containers (MTC) 1.6.0 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SSA-637483SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP22022-09-13csaf · siemens_psirtDE
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
WID-SEC-W-2022-0970Red Hat OpenShift: Mehrere SchwachstellenDeutsch2022-04-07csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.
GHSA-cph5-m8f7-6c5xaxios Inefficient Regular Expression Complexity vulnerability2021-09-01ghsa · osvUS
axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.
ICSA-22-258-05Siemens SINEC INS2022-09-13icsa · cisa_csaf_otUS
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
ICSA-24-277-02Subnet Solutions Inc. PowerSYSTEM Center2024-10-01icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in an attacker bypassing a proxy, creating a denial-of-service condition, or viewing sensitive information.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund cisa_csaf_ot nvd osv redhat_csaf siemens_psirt NVD CVE.org MITRE

published 2021-08-31modified 2026-06-17

references (58)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan