{"id":"CVE-2021-31525","aliases":["ALPINE-CVE-2021-31525","BELL-CVE-2021-31525","BIT-golang-2021-31525","DEBIAN-CVE-2021-31525","EUVD-2022-4104","GHSA-h86h-8ppg-mxmh","GO-2022-0236","MGASA-2021-0369","RHBA-2021:2979","RHSA-2021:2704","RHSA-2021:2984","RHSA-2021:3076","RHSA-2021:3248","RHSA-2021:3487","RHSA-2021:3555","RHSA-2021:4103","RHSA-2021:5072","RHSA-2022:0308","RLSA-2021:3076","SUSE-SU-2021:2082-1","SUSE-SU-2021:2085-1","UBUNTU-CVE-2021-31525","openSUSE-SU-2021:0904-1","openSUSE-SU-2024:10808-1","openSUSE-SU-2024:10809-1"],"status":"published","title":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.03692,"percentile":0.89866,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2021-05-27T12:17:11Z","modified":"2026-11-03T06:32:33Z","fixes":[{"ecosystem":"Go","package":"golang.org/x/net","fixed_in":["0.0.0-20210428140749-89ef3d95e781"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.15.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.15.12","1.16.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"golang-golang-x-net","fixed_in":["1:0.0+git20210119.5f4716e+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-golang-x-net","fixed_in":["1:0.0+git20210119.5f4716e+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-golang-x-net","fixed_in":["1:0.0+git20210119.5f4716e+dfsg-3"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.15.12","1.16.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.15","fixed_in":["1.15.12-1.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.15","fixed_in":["1.15.12-1.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.16","fixed_in":["1.16.4-1.14.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.16","fixed_in":["1.16.4-1.14.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"go1.15","fixed_in":["1.15.12-lp152.17.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20210428140749-89ef3d95e781"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.15.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.12"},{"introduced":"1.16.0"},{"fixed":"1.16.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20210119.5f4716e+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20210119.5f4716e+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-golang-x-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0+git20210119.5f4716e+dfsg-3"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20210428140749-89ef3d95e781"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.12"},{"introduced":"1.16.0-0"},{"fixed":"1.16.4"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20210428140749-89ef3d95e781"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.14-1.mga8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-4.rhaos4.7.git1d56dc8.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.4-7.rhaos4.7.git6287500.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.0-202107292242.p0.git.558d959.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"redhat-release-coreos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:47.84-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.22.0-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.2-8.rhaos4.8.git8d4264e.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.0-7.rhaos4.8.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.0-202107300027.p0.git.38b3ecc.assembly.stream.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+11833+614b07b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.6-3.rhaos4.6.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.6-3.rhaos4.6.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-3.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-4.git642a960.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-4.git642a960.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.2-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.9::el7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-287.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.9::el7","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-287.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.9::el7","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-287.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.9::el8","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-287.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.9::el8","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-287.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.9::el8","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-287.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-3.1.el8ost.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:storage:3.5:server:el7","package":"heketi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.0-2.el7rhgs"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:storage:3.5:server:el7","package":"heketi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.0-2.el7rhgs"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:storage:3.5:server:el7","package":"python-heketi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.0-2.el7rhgs"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:storage:3:client:el7","package":"heketi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.0-2.el7rhgs"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:storage:3:client:el7","package":"heketi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.0-2.el7rhgs"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.module+el8.4.0+396+d2d16ae3"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+632+4dba2916"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.14-1.module+el8.4.0+632+4dba2916"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-1.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-1.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-1.14.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-1.14.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-golang-x-net-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0+git20150226.3d87fd6-3","0.0+git20151007.b846920+dfsg-1","1:0.0+git20150817.66f0418-1","1:0.0+git20160110.4fd4a9f-1","1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1","1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1","20240716.00-0ubuntu1~16.04.0+esm2","20240716.00-0ubuntu1~16.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-golang-x-net-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20170629.c81e7f2+dfsg-1ubuntu1","1:0.0+git20170629.c81e7f2+dfsg-1ubuntu2","1:0.0+git20170629.c81e7f2+dfsg-2","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-golang-x-net-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20190811.74dc4d7+dfsg-1","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-lp152.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.15-1.2"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.8-1.1"}]}],"bundled":10}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web","article"]},{"url":"https://github.com/golang/go/issues/45710","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31525","tags":["web","advisory"]},{"url":"https://go.dev/cl/313069","tags":["web","fix"]},{"url":"https://go.dev/issue/45710","tags":["web","report"]},{"url":"https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0236","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h86h-8ppg-mxmh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-31525","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-31525","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-31525","tags":["advisory"]},{"url":"https://github.com/golang/go","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29037","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXHOWUQKHNS4LEJ2GTYWY2EEAYVCKECW/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4PG5AXR4LXEWYU5DHYEVESCXWKO3HFHO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QLUQXBCOPWP72ZSS3SM3CTURM7XOYALQ/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AKQH4LHYIFOWBEGMGHD7S7TTV7JL4U7W/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OZJXXUXBI66VV2PXRNAWN4MCE3AOHNBA/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2021:2979","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988937","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhba-2021_2979.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31525","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33195","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33197","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33198","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-34558","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34558","tags":["advisory"]},{"url":"https://golang.org/doc/devel/release#go1.15.minor","tags":["article"]},{"url":"https://golang.org/doc/devel/release#go1.16.minor","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2704","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971449","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2704.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27918","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33196","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2984","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988945","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2984.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3076","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.15.7_toolset","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1978567","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3076.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3248","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996707","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3248.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3487","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3487.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3555","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992955","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3555.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3703","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4103","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981345","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4103.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15586","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w/m/E6gHDs32AQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-16845","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16845","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/NyPIaucMgXo","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/mperVMGa98w","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5072","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5072.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0308","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2012287","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0308.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3076","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212082-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175132","tags":["report"]},{"url":"https://bugzilla.suse.com/1185790","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31525","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212085-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-31525","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FEBF3TK6RJGTIEOIZ3AQJ3GEDOBRMLER/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39293","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T12:17:11Z","modified":"2024-08-03T23:03:33.426Z","updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2022-4104","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T12:17:11Z","modified":"2024-08-03T23:03:33Z","updated_at":"2026-11-03T03:24:38.423371Z"}],"ghsa":[{"id":"GHSA-h86h-8ppg-mxmh","title":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion","description":"golang.org/x/net/http/httpguts in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2022-05-24T19:03:29Z","modified":"2024-05-20T20:31:00Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T13:15:08.207Z","modified":"2026-06-17T03:51:57.56Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"ALPINE-CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T13:15:08.207Z","modified":"2026-11-03T06:32:33.30738226Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"BELL-CVE-2021-31525","title":"CVE-2021-31525 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:31.965895Z","modified":"2026-01-26T09:47:58.009739Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T13:15:08.207Z","modified":"2026-10-20T10:54:40.255380487Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T13:15:08.207Z","modified":"2026-10-23T18:03:13.556226598Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-h86h-8ppg-mxmh","title":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion","description":"golang.org/x/net/http/httpguts in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2022-05-24T19:03:29Z","modified":"2026-09-10T03:49:23.210800038Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RHBA-2021:2979","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.7.23 packages update","status":"published","published":"2024-09-29T18:29:41Z","modified":"2026-08-05T10:08:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2021:2704","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.16.0","status":"published","published":"2024-09-30T14:16:14Z","modified":"2026-06-29T10:36:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2984","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.4 bug fix and security update","status":"published","published":"2024-09-30T14:17:59Z","modified":"2026-08-05T10:09:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3076","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T18:02:10Z","modified":"2026-06-29T10:36:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3248","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.9 packages and security update","status":"published","published":"2024-09-29T18:29:55Z","modified":"2026-08-05T10:09:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3487","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update","status":"published","published":"2024-09-29T18:30:09Z","modified":"2026-08-05T10:09:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3555","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.17.0","status":"published","published":"2024-09-30T14:18:38Z","modified":"2026-08-05T10:09:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4103","title":"Red Hat Security Advisory: OpenShift Virtualization 4.9.0 RPMs security and bug fix update","status":"published","published":"2024-09-18T04:20:14Z","modified":"2026-08-08T10:01:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5072","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update","status":"published","published":"2024-09-29T18:30:13Z","modified":"2026-08-05T10:09:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0308","title":"Red Hat Security Advisory: OpenShift Container Storage 3.11.z security and bug fix update","status":"published","published":"2024-09-18T04:21:15Z","modified":"2026-08-08T10:01:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:3076","title":"Moderate: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nThe following packages have been upgraded to a later upstream version: golang (1.15.14). (BZ#1982287)\n\nSecurity Fix(es):\n\n* golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader (CVE-2021-27918)\n\n* golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header (CVE-2021-31525)\n\n* golang: archive/zip: malformed archive may cause panic or memory exhaustion (CVE-2021-33196)\n\n* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* FIPS mode AES CBC CryptBlocks incorrectly re-initializes IV in file crypto/internal/boring/aes.go (BZ#1978567)\n\n* FIPS mode AES CBC Decrypter produces incorrect result (BZ#1983976)","status":"published","published":"2021-08-10T12:00:58Z","modified":"2026-02-05T07:30:11.469797Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2021-05-27T13:15:00Z","modified":"2026-06-23T00:30:06.823504157Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"BIT-golang-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.","status":"published","published":"2024-03-06T11:05:35.37Z","modified":"2026-09-08T08:47:48.21546816Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2022-0236","title":"Panic due to large headers in net/http and golang.org/x/net/http/httpguts","description":"A malicious HTTP server or client can cause the net/http client or server to panic.\n\nReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.\n\nThis also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts.","status":"published","published":"2022-07-15T23:04:18Z","modified":"2026-02-04T02:54:01.110291Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2021-0369","title":"Updated golang packages fix security vulnerabilities","description":"encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop\nif a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of\nan element. This can occur in the Decode, DecodeElement, or Skip method\n(CVE-2021-27918).\n\nnet/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers\nto cause a denial of service (panic) via a large header to ReadRequest or\nReadResponse. Server, Transport, and Client can each be affected in some\nconfigurations (CVE-2021-31525).\n\nA security issue has been found in Go before version 1.16.5. The LookupCNAME,\nLookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their\nrespective methods on the Resolver type may return arbitrary values retrieved\nfrom DNS which do not follow the established RFC 1035 rules for domain names.\nIf these names are used without further sanitization, for instance unsafely\nincluded in HTML, they may allow for injection of unexpected content. Note\nthat LookupTXT may still return arbitrary values that could require\nsanitization before further use (CVE-2021-33195).\n\nA security issue has been found in Go. Due to a pre-allocation optimization in\nzip.NewReader, a malformed archive which indicates it has a significant number\nof files can cause either a panic or memory exhaustion (CVE-2021-33196).\n\nReverseProxy fails to delete the Connection headers (as well as other legacy\nhop-by-hop headers, which however per RFC 7230 need to also be specified in\nConnection) if there are multiple ones and the first is empty, due to an\nincorrect Get(h) == \"\" check. This can lead to a security issue if the proxy\nis adding an important header, like X-Forwarded-For, and is sitting in front\nof another proxy which can be instructed by an attacker to drop that header as\na hop-by-hop header (CVE-2021-33197).\n\nA security issue has been found in Go before version 1.16.5. The SetString and\nUnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable\nfatal error if passed inputs with very large exponents (CVE-2021-33198).\n\nThe crypto/tls package of Go through 1.16.5 does not properly assert that the\ntype of public key in an X.509 certificate matches the expected type when\ndoing a RSA based key exchange, allowing a malicious TLS server to cause a TLS\nclient to panic (CVE-2021-34558).\n","status":"published","published":"2021-07-25T08:34:17Z","modified":"2026-04-16T04:41:34.082310587Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0904-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\n- Updated go to upstream version 1.15.12 (released 2021-05-06) (bsc#1175132).\n- CVE-2021-31525: Fixed stack overflow via net/http ReadRequest (bsc#1185790).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-23T18:07:02Z","modified":"2026-02-04T02:47:48.016889Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10808-1","title":"go1.15-1.15.15-1.2 on GA media","description":"These are all security issues fixed in the go1.15-1.15.15-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:55.765323Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10809-1","title":"go1.16-1.16.8-1.1 on GA media","description":"These are all security issues fixed in the go1.16-1.16.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:16:42.475775Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:2082-1","title":"Security update for go1.15","description":"This update for go1.15 fixes the following issues:\n\n- Updated go to upstream version 1.15.12 (released 2021-05-06) (bsc#1175132).\n- CVE-2021-31525: Fixed stack overflow via net/http ReadRequest (bsc#1185790).\n","status":"published","published":"2021-06-18T14:05:53Z","modified":"2026-02-04T04:09:21.015828Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2085-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\n- Updated go to upstream version 1.16.4 (released 2021-05-06) (bsc#1182345).\n- CVE-2021-31525: Fixed stack overflow via net/http ReadRequest (bsc#1185790).\n","status":"published","published":"2021-06-18T15:21:39Z","modified":"2026-02-04T03:38:59.791214Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}