{"id":"CVE-2021-46195","title":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c","summary":"GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-674"],"vendor":"gnu","product":"gcc","affected":["gcc = 12.0"],"patched":["codeready_linux_builder_v_9"],"published":"2022-01-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:17:12.637","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195","references":[{"url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","label":"cve@mitre.org"},{"url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46195.json"},{"url":"https://access.redhat.com/security/cve/CVE-2021-46195"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046300"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46195"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46195"},{"url":"https://access.redhat.com/errata/RHSA-2022:8415"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00798,"epssPercentile":0.56332,"scores":{"nvd":5.5,"vendor":3.3},"ingestedAt":"2026-10-08T23:16:47.329Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-08T21:11:37.947276Z"},"slug":"CVE-2021-46195","body":"## Overview\n\nGCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.\n\n## Affected\n\n- `gcc = 12.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2022:8415** · Red Hat · fixed in: Red Hat CodeReady Linux Builder (v. 9) · released 2022-11-15 · [advisory](https://access.redhat.com/errata/RHSA-2022:8415)\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-46195.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}