CVE-2021-28484: Infinite loop in Yubico yubihsm-connector
Summary
CVE-2021-28484: Infinite loop in Yubico yubihsm-connector. Affects github.com/Yubico/yubihsm-connector versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yubico yubihsm-connector is a Go package that provides a connector to interact with YubiHSM devices. It allows users to communicate with YubiHSMs over a network connection. The package is widely used for managing cryptographic keys and performing secure operations. However, a vulnerability has been discovered in the package that can lead to an infinite loop in the connector's API endpoint handler.
Vulnerability Detail
The vulnerability (CVE-2021-28484) exists in the /api/connector endpoint handler of Yubico yubihsm-connector before version 3.0.1. The handler fails to validate the length of incoming requests, allowing an attacker to send 0, 1, or 2 bytes to trigger an infinite loop. This loop causes the yubihsm-connector to become stuck waiting for data from the YubiHSM, rendering it unresponsive and preventing any further operations until the connector is restarted. The impact of this vulnerability is a denial-of-service (DoS) condition, where legitimate users are unable to use the connector until the issue is resolved.
How To Fix
Latest published version: v0.0.0-20260910090226-753a3333ee41 as of 22 Oct 2026
go get github.com/Yubico/yubihsm-connector@v0.0.0-20260910090226-753a3333ee41Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.1
This is the first release that contains the fix.
go get github.com/Yubico/yubihsm-connector@v3.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, the Yubico yubihsm-connector package before version 3.0.1 is vulnerable to an infinite loop issue that can lead to a denial-of-service condition. Users are advised to upgrade to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/Yubico/yubihsm-connector →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition, where the yubihsm-connector becomes unresponsive and prevents any further operations until restarted.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the time of this report. However, it is recommended to upgrade to the fixed version to mitigate any potential risks.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8m9g-647g-5pxw/GHSA-8m9g-647g-5pxw.json).
