CVE-2021-38561
golang.org/x/text/language Out-of-bounds Read vulnerability
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
CVE-2021-38561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
CVE-2021-38561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2022-7707
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
EUVD-2022-7707- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ppp9-7jff-5vj2
golang.org/x/text/language Out-of-bounds Read vulnerability
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
GHSA-ppp9-7jff-5vj2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-38561
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
ALPINE-CVE-2021-38561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-41221
CVE-2021-38561 affecting package multus for versions less than 4.0.2-1
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
AZL-41221- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSVAZL-41469
CVE-2021-38561 affecting package cni for versions less than 1.1.2-2
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
AZL-41469- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVAZL-44622
CVE-2021-38561 affecting package podman for versions less than 5.6.1-2
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
AZL-44622- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-44952
CVE-2021-38561 affecting package buildah for versions less than 1.41.4-2
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
AZL-44952- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-45375
CVE-2021-38561 affecting package containernetworking-plugins for versions less than 1.6.1-4
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
AZL-45375- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
CVE-2021-38561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-38561
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
DEBIAN-CVE-2021-38561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-ppp9-7jff-5vj2
golang.org/x/text/language Out-of-bounds Read vulnerability
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
GHSA-ppp9-7jff-5vj2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRHBA-2023:1649
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.35 packages and security update
- Record
RHBA-2023:1649- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:0407
Red Hat Security Advisory: OpenShift Virtualization 4.12.0 RPMs security update
- Record
RHSA-2023:0407- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-38561
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
- Record
UBUNTU-CVE-2021-38561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2021-0113 No score
Out-of-bounds read in golang.org/x/text/language
Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack.
- Record
GO-2021-0113- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12599-1 No score
cni-1.1.2-2.1 on GA media
These are all security issues fixed in the cni-1.1.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12599-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14015-1 No score
gitleaks-8.18.3-1.1 on GA media
These are all security issues fixed in the gitleaks-8.18.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14015-1- Updated
- 2026-11-02
OSVUSN-5873-1 No score
golang-golang-x-text, golang-x-text vulnerabilities
It was discovered that Go Text incorrectly handled certain encodings. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14040)
It was discovered that Go Text incorrectly handled certain BCP 47 language tags. An attacker could possibly use this issue to cause a denial of service. CVE-2020-28851, CVE-2020-28852 and CVE-2021-38561 affected only Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28851, CVE-2020-28852, CVE-2021-38561, CVE-2022-32149)
- Record
USN-5873-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang.org/x/textGo |
before 0.3.7 | 0.3.7 |
git-lfsAlpine:v3.16 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.17 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.18 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.19 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.20 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.21 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.22 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.23 |
before 3.1.2-r3 | 3.1.2-r3 |
git-lfsAlpine:v3.24 |
before 3.1.2-r3 | 3.1.2-r3 |
Show 51 moreShow less
| Package | Affected | Fixed |
|---|---|---|
multusAzure Linux:3 |
before 4.0.2-1 | 4.0.2-1 |
cniAzure Linux:3 |
before 1.1.2-2 | 1.1.2-2 |
podmanAzure Linux:3 |
before 5.6.1-2 | 5.6.1-2 |
buildahAzure Linux:3 |
before 1.41.4-2 | 1.41.4-2 |
containernetworking-pluginsAzure Linux:3 |
before 1.6.1-4 | 1.6.1-4 |
golang-golang-x-textDebian:12 |
before 0.3.7-1 | 0.3.7-1 |
golang-golang-x-textDebian:13 |
before 0.3.7-1 | 0.3.7-1 |
golang-golang-x-textDebian:14 |
before 0.3.7-1 | 0.3.7-1 |
cri-oRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:1.24.5-2.rhaos4.11.gitb007cb6.el8 | 0:1.24.5-2.rhaos4.11.gitb007cb6.el8 |
cri-o-debuginfoRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:1.24.5-2.rhaos4.11.gitb007cb6.el8 | 0:1.24.5-2.rhaos4.11.gitb007cb6.el8 |
cri-o-debugsourceRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:1.24.5-2.rhaos4.11.gitb007cb6.el8 | 0:1.24.5-2.rhaos4.11.gitb007cb6.el8 |
haproxyRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:2.2.24-3.rhaos4.11.el8 | 0:2.2.24-3.rhaos4.11.el8 |
haproxy-debugsourceRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:2.2.24-3.rhaos4.11.el8 | 0:2.2.24-3.rhaos4.11.el8 |
haproxy22Red Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:2.2.24-3.rhaos4.11.el8 | 0:2.2.24-3.rhaos4.11.el8 |
haproxy22-debuginfoRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:2.2.24-3.rhaos4.11.el8 | 0:2.2.24-3.rhaos4.11.el8 |
kernel-rtRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-coreRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debugRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-coreRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-debuginfoRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-develRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-kvmRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-modulesRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-modules-extraRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debug-modules-internalRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debuginfoRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-debuginfo-common-x86_64Red Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-develRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-kvmRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-modulesRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-modules-extraRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-modules-internalRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
kernel-rt-selftests-internalRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.18.0-372.51.1.rt7.208.el8_6 | 0:4.18.0-372.51.1.rt7.208.el8_6 |
openshiftRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8 | 0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.11::el8 From an advisory covering 2 CVEs |
before 0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8 | 0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8 |
kubevirtRed Hat:container_native_virtualization:4.12::el7 From an advisory covering 14 CVEs |
before 0:4.12.0-1057.el7 | 0:4.12.0-1057.el7 |
kubevirt-virtctlRed Hat:container_native_virtualization:4.12::el7 From an advisory covering 14 CVEs |
before 0:4.12.0-1057.el7 | 0:4.12.0-1057.el7 |
kubevirt-virtctl-redistributableRed Hat:container_native_virtualization:4.12::el7 From an advisory covering 14 CVEs |
before 0:4.12.0-1057.el7 | 0:4.12.0-1057.el7 |
kubevirtRed Hat:container_native_virtualization:4.12::el8 From an advisory covering 14 CVEs |
before 0:4.12.0-1057.el8 | 0:4.12.0-1057.el8 |
kubevirt-virtctlRed Hat:container_native_virtualization:4.12::el8 From an advisory covering 14 CVEs |
before 0:4.12.0-1057.el8 | 0:4.12.0-1057.el8 |
kubevirt-virtctl-redistributableRed Hat:container_native_virtualization:4.12::el8 From an advisory covering 14 CVEs |
before 0:4.12.0-1057.el8 | 0:4.12.0-1057.el8 |
golang-x-textUbuntu:16.04:LTS |
All versions, plus listed versions 0+git20151019.0fe7e68-0ubuntu10+git20151217.cf49866-0ubuntu1 |
None known |
golang-x-textUbuntu:18.04:LTS |
before 0.0~git20170627.0.6353ef0-1ubuntu2.1, plus listed versions 0.0~git20170627.0.6353ef0-1ubuntu10.0~git20170627.0.6353ef0-1ubuntu2 |
0.0~git20170627.0.6353ef0-1ubuntu2.1 |
golang-golang-x-textUbuntu:20.04:LTS |
before 0.3.2-4ubuntu0.1, plus listed versions 0.3.2-30.3.2-4 |
0.3.2-4ubuntu0.1 |
golang-x-textUbuntu:20.04:LTS |
All versions, plus listed versions 0.3.2-1 |
None known |
golang-golang-x-textUbuntu:22.04:LTS |
before 0.3.7-1, plus listed versions 0.3.6-1 |
0.3.7-1 |
golang-x-textUbuntu:18.04:LTS From an advisory covering 5 CVEs |
before 0.0~git20170627.0.6353ef0-1ubuntu2.1, plus listed versions 0.0~git20170627.0.6353ef0-1ubuntu10.0~git20170627.0.6353ef0-1ubuntu2 |
0.0~git20170627.0.6353ef0-1ubuntu2.1 |
golang-golang-x-textUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 0.3.2-4ubuntu0.1, plus listed versions 0.3.2-30.3.2-4 |
0.3.2-4ubuntu0.1 |
golang-golang-x-textUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 0.3.7-1ubuntu0.20.04.1, plus listed versions 0.3.6-10.3.7-1 |
0.3.7-1ubuntu0.20.04.1 |
cniopenSUSE:Tumbleweed |
before 1.1.2-2.1 | 1.1.2-2.1 |
gitleaksopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 8.18.3-1.1 | 8.18.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38561 is a high vulnerability (CVSS 7.5) in Golang Text, published October 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in golang.org/x/text 0.3.7.
References
groups.google.com/g/golang-announce
go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
deps.dev/advisory/OSV/GO-2021-0113
pkg.go.dev/golang.org/x/text/language
nvd.nist.gov/vuln/detail/CVE-2021-38561
go.dev/cl/340830
Show 93 moreShow less
github.com/advisories/GHSA-ppp9-7jff-5vj2
security.alpinelinux.org/vuln/CVE-2021-38561
security-tracker.debian.org/tracker/CVE-2021-38561
access.redhat.com/errata/RHBA-2023:1649
issues.redhat.com/browse/OCPBUGS-11407
security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_1649.json
bugzilla.redhat.com/show_bug.cgi?id=2100495
cve.org/CVERecord?id=CVE-2021-38561
haproxy.com/blog/february-2023-header-parser-fixed
mail-archive.com/[email protected]/msg43229.html
ubuntu.com/security/CVE-2021-38561
suse.com/security/cve/CVE-2021-38561