CVE-2021-27919
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon...
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
CVE-2021-27919- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
CVE-2021-27919- Updated
- 2026-11-02
EUVDEUVD-2021-14642 No score
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
EUVD-2021-14642- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7gg-6p99-5jxq
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon...
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
GHSA-v7gg-6p99-5jxq- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALPINE-CVE-2021-27919
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
ALPINE-CVE-2021-27919- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2021-27919
CVE-2021-27919 does not affect BellSoft software
- Record
BELL-CVE-2021-27919- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSV
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
CVE-2021-27919- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-27919
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
UBUNTU-CVE-2021-27919- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-golang-2021-27919 No score
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Record
BIT-golang-2021-27919- Updated
- 2026-11-02
OSVGO-2021-0067 No score
Panic when opening archives in archive/zip
Using Reader.Open on an archive containing a file with a path prefixed by "../" will cause a panic due to a stack overflow. If parsing user supplied archives, this may be used as a denial of service vector.
- Record
GO-2021-0067- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10809-1 No score
go1.16-1.16.8-1.1 on GA media
These are all security issues fixed in the go1.16-1.16.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10809-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0937-1 No score
Security update for go1.16
This update for go1.16 fixes the following issues:
- go1.16.2 (released 2021-03-11) (bsc#1182345)
- go1.16.1 (released 2021-03-10) (bsc#1182345)
- CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader (bsc#1183333).
- CVE-2021-27919: Fixed an issue where archive/zip: can panic when calling Reader.Open (bsc#1183334).
- Record
SUSE-SU-2021:0937-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
goAlpine:v3.13 |
1.16.0 up to 1.15.10-r0 | 1.15.10-r0 |
goAlpine:v3.14 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.15 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.16 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.17 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.18 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.19 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.20 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.21 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.22 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
goAlpine:v3.23 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
goAlpine:v3.24 |
1.16.0 up to 1.16.2-r0 | 1.16.2-r0 |
golangBitnami |
1.16.0 up to 1.16.1 | 1.16.1 |
stdlibGo |
1.16.0-0 up to 1.16.1 | 1.16.1 |
go1.16SUSE:Linux Enterprise Module for Development Tools 15 SP2 From an advisory covering 2 CVEs |
before 1.16.2-1.8.1 | 1.16.2-1.8.1 |
golang-1.10Ubuntu:14.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~14.04.1 |
None known |
golang-1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2 |
None known |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
golang-1.13Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3 |
None known |
golang-1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2 |
None known |
golang-1.13Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1 |
None known |
golang-1.8Ubuntu:18.04:LTS |
All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 |
None known |
golang-1.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 |
None known |
golang-1.13Ubuntu:20.04:LTS |
All versions, plus listed versions 1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1 Show 5 moreShow less1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2 |
None known |
golang-1.14Ubuntu:20.04:LTS |
All versions, plus listed versions 1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1 Show 4 moreShow less1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2 |
None known |
golang-1.13Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2 |
None known |
go1.16openSUSE:Tumbleweed From an advisory covering 10 CVEs |
before 1.16.8-1.1 | 1.16.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-27919 is a medium vulnerability (CVSS 5.5) in Golang Go, published March 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in go 1.15.10-r0.
References
groups.google.com/g/golang-announce/c/MfiLYjG-RAw
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G
security.gentoo.org/glsa/202208-02
nvd.nist.gov/vuln/detail/CVE-2021-27919
Show 24 moreShow less
github.com/advisories/GHSA-v7gg-6p99-5jxq
security.alpinelinux.org/vuln/CVE-2021-27919
docs.bell-sw.com/security/cves/CVE-2021-27919
go.dev/cl/300489
go.googlesource.com/go/+/cd3b4ca9f20fd14187ed4cdfdee1a02ea87e5cd8
suse.com/support/update/announcement/2021/suse-su-20210937-1
bugzilla.suse.com/1182345
ubuntu.com/security/CVE-2021-27919
cve.org/CVERecord?id=CVE-2021-27919