CVE-2021-4467 Positive Technologies MaxPatrol 8 & XSpider Remote DoS
Unauthenticated remote attackers can cause service disruption in Positive Technologies MaxPatrol 8 and XSpider by exhausting session identifiers via repeated HTTPS requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4467?
CVE-2021-4467 is a high-severity denial of service vulnerability in Positive Technologies MaxPatrol 8 (Server), published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The service generates a new session identifier for each incoming connection without adequately limiting concurrent requests. An unauthenticated remote attacker can repeatedly issue HTTPS requests to the service, causing excessive allocation of session identifiers. Under load, session identifier collisions may occur, forcing active client sessions to disconnect and resulting in service disruption.
Weakness: CWE-400
Which versions are affected by CVE-2021-4467?
How do I fix CVE-2021-4467?
No fix has been published for CVE-2021-4467 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-4467 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-4467 exists.
Sources
Also known as GHSA-q46v-hq83-2jxm.