Every CVE Search/ Get API key

CVE-2021-3115

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and...

7.5 HighFix available

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.91%Down 14.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
CVE-2021-3115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness
CWE-427
Updated
2026-11-02
CVE List No score

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
CVE-2021-3115
Updated
2026-11-02
EUVDEUVD-2021-26467 No score

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
EUVD-2021-26467
Updated
2026-11-03
GitHub AdvisoriesGHSA-79cw-x93g-q95p 7.5

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and...

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
GHSA-79cw-x93g-q95p
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-94, CWE-427
Updated
2026-11-02
OSVALPINE-CVE-2021-3115 7.5

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
ALPINE-CVE-2021-3115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-38572 7.5

CVE-2021-3115 affecting package python-tensorboard for versions less than 2.16.2-1

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
AZL-38572
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVBELL-CVE-2021-3115 7.5

CVE-2021-3115 does not affect BellSoft software

Record
BELL-CVE-2021-3115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.5

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
CVE-2021-3115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3115 7.5

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
DEBIAN-CVE-2021-3115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:1339 7.5

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.14.0 and security update

Record
RHSA-2021:1339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:1746 7.5

Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

Record
RHSA-2021:1746
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:2095 7.5

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.14.1 security update

Record
RHSA-2021:2095
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:1746 7.5

Moderate: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The following packages have been upgraded to a later upstream version: golang (1.15.7), delve (1.5.0). (BZ#1870531)

Security Fix(es):

  • golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  • golang: cmd/go: packages using cgo can cause arbitrary code execution at build time (CVE-2021-3115)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Record
RLSA-2021:1746
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-golang-2021-3115 No score

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

Record
BIT-golang-2021-3115
Updated
2026-11-02
OSVGO-2021-0068 No score

Arbitrary code injection via the go command with cgo on Windows in cmd/go

The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built.

Record
GO-2021-0068
Updated
2026-11-02
OSVopenSUSE-SU-2021:0190-1 No score

Security update for go1.14

This update for go1.14 fixes the following issues:

Go was updated to version 1.14.14 (bsc#1164903).

Security issues fixed:

  • CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).
  • CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0190-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0192-1 No score

Security update for go1.15

This update for go1.15 fixes the following issues:

Go was updated to version 1.15.7 (bsc#1175132).

Security issues fixed:

  • CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).
  • CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0192-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0194-1 No score

Security update for go1.14

This update for go1.14 fixes the following issues:

Go was updated to version 1.14.14 (bsc#1164903).

Security issues fixed:

  • CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).
  • CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0194-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10807-1 No score

go1.14-1.14.15-1.6 on GA media

These are all security issues fixed in the go1.14-1.14.15-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10807-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10808-1 No score

go1.15-1.15.15-1.2 on GA media

These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10808-1
Updated
2026-11-02
OSVSUSE-SU-2021:0222-1 No score

Security update for go1.14

This update for go1.14 fixes the following issues:

Go was updated to version 1.14.14 (bsc#1164903).

Security issues fixed:

  • CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).
  • CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).
Record
SUSE-SU-2021:0222-1
Updated
2026-11-02
OSVSUSE-SU-2021:0223-1 No score

Security update for go1.15

This update for go1.15 fixes the following issues:

Go was updated to version 1.15.7 (bsc#1175132).

Security issues fixed:

  • CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic (bsc#1181145).
  • CVE-2021-3115: Fixed a potential arbitrary code execution in the build process (bsc#1181146).
Record
SUSE-SU-2021:0223-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
go
Alpine:v3.13
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.14
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.15
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.16
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.17
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.18
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.19
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.20
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.21
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.22
 1.15 up to 1.15.7-r0
1.15.7-r0
Show 47 moreShow less
Affected packages
PackageAffectedFixed
go
Alpine:v3.23
 1.15 up to 1.15.7-r0
1.15.7-r0
go
Alpine:v3.24
 1.15 up to 1.15.7-r0
1.15.7-r0
python-tensorboard
Azure Linux:3
 before 2.16.2-1
2.16.2-1
golang
Bitnami
 before 1.14.14, 1.15.0 up to 1.15.7
1.14.141.15.7
golang-1.15
Debian:11
 before 1.15.7-1
1.15.7-1
toolchain
Go
 before 1.14.14, 1.15.0-0 up to 1.15.7
1.14.141.15.7
openshift-serverless-clients
Red Hat:serverless:1.0::el8
From an advisory covering 2 CVEs
 before 0:0.20.0-6.el8
0:0.20.0-6.el8
delve
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
delve-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
delve-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
0:1.5.0-2.module+el8.4.0+8864+58b0fcdb
go-toolset
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang-bin
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang-misc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang-race
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang-src
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
golang-tests
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
0:1.15.7-1.module+el8.4.0+9580+3b0e6c24
openshift-serverless-clients
Red Hat:serverless:1.0::el8
From an advisory covering 2 CVEs
 before 0:0.20.0-7.el8
0:0.20.0-7.el8
delve
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.5.0-2.module+el8.4.0+396+d2d16ae3
0:1.5.0-2.module+el8.4.0+396+d2d16ae3
golang
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+396+d2d16ae3
0:1.15.7-1.module+el8.4.0+396+d2d16ae3
go-toolset
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.15.7-1.module+el8.4.0+396+d2d16ae3
0:1.15.7-1.module+el8.4.0+396+d2d16ae3
go1.14
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Manager Proxy 4.0
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Manager Server 4.0
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.14
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 1.14.14-1.32.1
1.14.14-1.32.1
go1.15
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Manager Proxy 4.0
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Manager Server 4.0
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.15
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 1.15.7-1.17.1
1.15.7-1.17.1
go1.14
openSUSE:Leap 15.1
From an advisory covering 2 CVEs
 before 1.14.14-lp151.28.1
1.14.14-lp151.28.1
go1.15
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 1.15.7-lp152.8.1
1.15.7-lp152.8.1
go1.14
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 1.14.14-lp152.2.18.1
1.14.14-lp152.2.18.1
go1.14
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.14.15-1.6
1.14.15-1.6
go1.15
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 1.15.15-1.2
1.15.15-1.2

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3115 is a high vulnerability (CVSS 7.5) in Golang Go, published January 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.91%, the 94th percentile. Fixed in go 1.15.7-r0.

References

Show 57 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open