Register for the AI for Security Summit: Join Figma, Perplexity & Wiz

CVE-2021-20201
NixOS vulnerability analysis and mitigation

Overview

CVE-2021-20201 is a vulnerability discovered in SPICE (Simple Protocol for Independent Computing Environments) versions before 0.14.92. The vulnerability affects the remote display system built for virtual environments that allows users to view computing desktops from anywhere on the Internet (Red Hat Advisory).

Technical details

The vulnerability involves a flaw in the TLS renegotiation mechanism where remote attackers can cause a denial of service through CPU consumption by performing multiple renegotiations within a single connection. The issue has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

Impact

When exploited, this vulnerability can lead to denial of service through excessive CPU consumption on affected servers. The attack is particularly effective because it can be executed over a single TCP connection, making it harder for external DoS mitigation tools to detect (Qualys Blog).

Exploitability

The vulnerability is exploitable remotely and requires no authentication. The attack can be executed by requesting many new SSL connections per second or by using the renegotiation feature to force a server to perform multiple expensive cryptographic operations over a single TCP connection (Qualys Blog).

Mitigation and workarounds

The vulnerability has been fixed in SPICE version 0.14.92 and later. For affected systems, it is recommended to upgrade to the patched version. For Red Hat Enterprise Linux users, updates are available through RHSA-2021:1924. Gentoo users should upgrade to version 0.15.0 or later (Gentoo Advisory, Red Hat Advisory).

Additional resources

Linux Distribution fix status

Fix availability across major Linux distributions and their releases.

Alpine

Fixed

edge

spice: 0.14.3-r1

Fixed

v3.18

spice: 0.14.3-r1

Fixed

v3.19

spice: 0.14.3-r1

Fixed

v3.20

spice: 0.14.3-r1

Fixed

v3.21

spice: 0.14.3-r1

Fixed

v3.22

spice: 0.14.3-r1

Fixed

v3.23

spice: 0.14.3-r1

Fixed

Arch Linux

Fixed

rolling

spice: 0.15.0-1

Fixed

SourceThis report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-91782LOW1.9
  • NixOS logoNixOS
  • binutils
NoYesSep 15, 2026
CVE-2026-91781LOW1.9
  • NixOS logoNixOS
  • binutils
NoYesSep 15, 2026
CVE-2026-91780LOW1.9
  • NixOS logoNixOS
  • binutils
NoNoSep 15, 2026
CVE-2026-91779LOW1.9
  • NixOS logoNixOS
  • binutils
NoNoSep 15, 2026
CVE-2026-90831LOW1.9
  • NixOS logoNixOS
  • seal-binutils
NoYesSep 14, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management