Every CVE Search/ Get API key

CVE-2021-41771

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17...

7.5 HighFix available

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.70%Up 4.3 points since Nov 8, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
CVE-2021-41771
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
CVE-2021-41771
Updated
2026-11-02
EUVDEUVD-2021-28779 No score

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
EUVD-2021-28779
Updated
2026-11-03
GitHub AdvisoriesGHSA-g56w-5r6h-483w 7.5

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17...

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
GHSA-g56w-5r6h-483w
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2021-41771 7.5

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
ALPINE-CVE-2021-41771
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-6451 7.5

CVE-2021-41771 affecting package golang for versions less than 1.17.8-1

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
AZL-6451
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 21 moreShow less
OSVAZL-79102 7.5

CVE-2021-41771 affecting package golang 1.26.10-1

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
AZL-79102
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-98868 7.5

CVE-2021-41771 affecting package golang 1.27.1-1

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
AZL-98868
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-41771 7.5

CVE-2021-41771 does not affect BellSoft software

Record
BELL-CVE-2021-41771
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
CVE-2021-41771
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-41771 7.5

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
DEBIAN-CVE-2021-41771
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2021-1443 5.5

golang security update

The Go Programming Language.

Security Fix(es):

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.(CVE-2021-41771)

Record
OESA-2021-1443
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:1745 7.5

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.22.0

Record
RHSA-2022:1745
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:1819 9.8

Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update

Record
RHSA-2022:1819
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:1819 9.8

Moderate: go-toolset:rhel8 security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • golang: Command-line arguments may overwrite global data (CVE-2021-38297)

  • golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

  • golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

  • golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

  • golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

  • golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

  • golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:1819
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-41771 7.5

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
UBUNTU-CVE-2021-41771
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVALSA-2022:1819 No score

Moderate: go-toolset:rhel8 security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • golang: Command-line arguments may overwrite global data (CVE-2021-38297)

  • golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

  • golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

  • golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

  • golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

  • golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

  • golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:1819
Updated
2026-11-02
OSVBIT-golang-2021-41771 No score

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

Record
BIT-golang-2021-41771
Updated
2026-11-02
OSVGO-2021-0263 No score

Panic on invalid symbol tables in debug/macho

Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table.

Record
GO-2021-0263
Updated
2026-11-02
OSVMGASA-2021-0537 No score

Updated golang packages fix security vulnerability

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. (CVE-2021-41771)

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. (CVE-2021-41772)

Record
MGASA-2021-0537
Updated
2026-11-02
OSVopenSUSE-SU-2021:1539-1 No score

Security update for go1.16

This update for go1.16 fixes the following issues:

Security update go1.16.10 (released 2021-11-04) (bsc#1182345).

  • CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
  • CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1539-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3833-1 No score

Security update for go1.17

This update for go1.17 fixes the following issues:

Security update go1.17.3 (released 2021-11-04) (bsc#1190649).

  • CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
  • CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).
Record
openSUSE-SU-2021:3833-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3834-1 No score

Security update for go1.16

This update for go1.16 fixes the following issues:

Security update go1.16.10 (released 2021-11-04) (bsc#1182345).

  • CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
  • CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).
Record
openSUSE-SU-2021:3834-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11609-1 No score

go1.16-1.16.10-1.1 on GA media

These are all security issues fixed in the go1.16-1.16.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11609-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11610-1 No score

go1.17-1.17.3-1.1 on GA media

These are all security issues fixed in the go1.17-1.17.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11610-1
Updated
2026-11-02
OSVSUSE-SU-2021:3833-1 No score

Security update for go1.17

This update for go1.17 fixes the following issues:

Security update go1.17.3 (released 2021-11-04) (bsc#1190649).

  • CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
  • CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).
Record
SUSE-SU-2021:3833-1
Updated
2026-11-02
OSVSUSE-SU-2021:3834-1 No score

Security update for go1.16

This update for go1.16 fixes the following issues:

Security update go1.16.10 (released 2021-11-04) (bsc#1182345).

  • CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).
  • CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).
Record
SUSE-SU-2021:3834-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
go
Alpine:v3.14
 1.17.0 up to 1.16.10-r0
1.16.10-r0
go
Alpine:v3.15
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.16
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.17
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.18
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.19
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.20
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.21
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.22
 1.17.0 up to 1.17.3-r0
1.17.3-r0
go
Alpine:v3.23
 1.17.0 up to 1.17.3-r0
1.17.3-r0
Show 50 moreShow less
Affected packages
PackageAffectedFixed
go
Alpine:v3.24
 1.17.0 up to 1.17.3-r0
1.17.3-r0
delve
AlmaLinux:8
 before 1.7.2-1.module_el8.6.0+2736+ec10aba8
1.7.2-1.module_el8.6.0+2736+ec10aba8
go-toolset
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang-bin
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang-docs
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang-misc
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang-race
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang-src
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang-tests
AlmaLinux:8
 before 1.17.7-1.module_el8.6.0+2736+ec10aba8
1.17.7-1.module_el8.6.0+2736+ec10aba8
golang
Azure Linux:2
 before 1.17.8-1
1.17.8-1
golang
Azure Linux:3
 through 1.26.10-1 None known
golang
Azure Linux:3
 1.27.0 to 1.27.1-1 None known
golang
Bitnami
 before 1.16.10, 1.17.0 up to 1.17.3
1.16.101.17.3
golang-1.15
Debian:11
 before 1.15.15-1~deb11u2, plus listed versions
1.15.15-1~deb11u11.15.9-6
1.15.15-1~deb11u2
golang-1.8
Debian:9
 before 1.8.1-1+deb9u4, plus listed versions
1.8.1-11.8.1-1+deb9u11.8.1-1+deb9u21.8.1-1+deb9u3
1.8.1-1+deb9u4
golang-1.7
Debian:9
 before 1.7.4-2+deb9u4, plus listed versions
1.7.4-21.7.4-2+deb9u11.7.4-2+deb9u21.7.4-2+deb9u3
1.7.4-2+deb9u4
golang-1.11
Debian:10
 before 1.11.6-1+deb10u6, plus listed versions
1.11.6-11.11.6-1+deb10u11.11.6-1+deb10u21.11.6-1+deb10u31.11.6-1+deb10u41.11.6-1+deb10u5
1.11.6-1+deb10u6
stdlib
Go
 before 1.16.10, 1.17.0-0 up to 1.17.3
1.16.101.17.3
golang
Mageia:8
 before 1.17.3-1.mga8
1.17.3-1.mga8
golang
openEuler:20.03-LTS-SP1
 before 1.15.7-6.oe1
1.15.7-6.oe1
golang
openEuler:20.03-LTS-SP2
 before 1.15.7-6.oe1
1.15.7-6.oe1
openshift-serverless-clients
Red Hat:serverless:1.0::el8
 before 0:1.1.0-2.el8
0:1.1.0-2.el8
delve
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.2-1.module+el8.6.0+12972+ebab5911
0:1.7.2-1.module+el8.6.0+12972+ebab5911
delve-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.2-1.module+el8.6.0+12972+ebab5911
0:1.7.2-1.module+el8.6.0+12972+ebab5911
delve-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.2-1.module+el8.6.0+12972+ebab5911
0:1.7.2-1.module+el8.6.0+12972+ebab5911
go-toolset
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang-bin
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang-docs
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang-misc
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang-race
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang-src
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
golang-tests
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.7-1.module+el8.6.0+14297+32a15e19
0:1.17.7-1.module+el8.6.0+14297+32a15e19
delve
Rocky Linux:8
 before 0:1.7.2-1.module+el8.6.0+824+8e984c20
0:1.7.2-1.module+el8.6.0+824+8e984c20
golang
Rocky Linux:8
 before 0:1.17.7-1.module+el8.6.0+824+8e984c20
0:1.17.7-1.module+el8.6.0+824+8e984c20
go-toolset
Rocky Linux:8
 before 0:1.17.7-1.module+el8.6.0+824+8e984c20
0:1.17.7-1.module+el8.6.0+824+8e984c20
go1.17
SUSE:Linux Enterprise Module for Development Tools 15 SP2
 before 1.17.3-1.9.1
1.17.3-1.9.1
go1.17
SUSE:Linux Enterprise Module for Development Tools 15 SP3
 before 1.17.3-1.9.1
1.17.3-1.9.1
go1.16
SUSE:Linux Enterprise Module for Development Tools 15 SP2
 before 1.16.10-1.32.1
1.16.10-1.32.1
go1.16
SUSE:Linux Enterprise Module for Development Tools 15 SP3
 before 1.16.10-1.32.1
1.16.10-1.32.1
golang-1.16
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
golang-1.16
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1
 None known
golang-1.17
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3
 None known
go1.16
openSUSE:Leap 15.2
 before 1.16.10-lp152.17.1
1.16.10-lp152.17.1
go1.17
openSUSE:Leap 15.3
 before 1.17.3-1.9.1
1.17.3-1.9.1
go1.16
openSUSE:Leap 15.3
 before 1.16.10-1.32.1
1.16.10-1.32.1
go1.16
openSUSE:Tumbleweed
 before 1.16.10-1.1
1.16.10-1.1
go1.17
openSUSE:Tumbleweed
 before 1.17.3-1.1
1.17.3-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41771 is a high vulnerability (CVSS 7.5) in Golang Go, published November 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.70%, the 91st percentile. Fixed in go 1.16.10-r0.

References

Show 84 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open