CVE-2021-21708: 
PHP vulnerability analysis and mitigation

CVE-2021-21708 is a vulnerability in PHP's filter functions when using FILTER_VALIDATE_FLOAT filter with min/max limits. The vulnerability affects PHP versions 7.4.x before 7.4.28, 8.0.x before 8.0.16, and 8.1.x before 8.1.3. The issue occurs when the filter fails, leading to a use-after-free vulnerability (NetApp Security).

The vulnerability is caused by a malformed php_filter_float() function that can trigger a use-after-free condition when the filter fails for integers. The issue manifests when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits (PHP Bug Report).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability has been assigned a CVSS score of 9.8 (CRITICAL) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NetApp Security).

The vulnerability has been fixed in PHP versions 7.4.28, 8.0.16, and 8.1.3. Users are advised to upgrade to these or later versions. The fix was committed to the PHP source code repository and is available in the referenced commits (PHP Bug Report).