{"id":"CVE-2021-38561","aliases":["ALPINE-CVE-2021-38561","AZL-41221","AZL-41469","AZL-44622","AZL-44952","AZL-45375","DEBIAN-CVE-2021-38561","EUVD-2022-7707","GHSA-ppp9-7jff-5vj2","GO-2021-0113","RHBA-2023:1649","RHSA-2023:0407","UBUNTU-CVE-2021-38561","USN-5873-1","openSUSE-SU-2024:12599-1","openSUSE-SU-2024:14015-1"],"status":"published","title":"golang.org/x/text/language Out-of-bounds Read vulnerability","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01484,"percentile":0.74332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2021-10-06T17:51:21Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"golang.org/x/text","fixed_in":["0.3.7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"git-lfs","fixed_in":["3.1.2-r3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"multus","fixed_in":["4.0.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cni","fixed_in":["1.1.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"podman","fixed_in":["5.6.1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"buildah","fixed_in":["1.41.4-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containernetworking-plugins","fixed_in":["1.6.1-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"golang-golang-x-text","fixed_in":["0.3.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-golang-x-text","fixed_in":["0.3.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-golang-x-text","fixed_in":["0.3.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"golang-x-text","fixed_in":["0.0~git20170627.0.6353ef0-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"golang-golang-x-text","fixed_in":["0.3.2-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"golang-golang-x-text","fixed_in":["0.3.7-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cni","fixed_in":["1.1.2-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"multus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-1"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/text","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.7"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/text","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.5-2.rhaos4.11.gitb007cb6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.5-2.rhaos4.11.gitb007cb6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.5-2.rhaos4.11.gitb007cb6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"kernel-rt-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0-372.51.1.rt7.208.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.0-202304042055.p0.g8f6c8a6.assembly.stream.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.12::el7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1057.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.12::el7","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1057.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.12::el7","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1057.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.12::el8","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1057.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.12::el8","package":"kubevirt-virtctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1057.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:container_native_virtualization:4.12::el8","package":"kubevirt-virtctl-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-1057.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0+git20151019.0fe7e68-0ubuntu1","0+git20151217.cf49866-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20170627.0.6353ef0-1ubuntu2.1"}]}],"versions":["0.0~git20170627.0.6353ef0-1ubuntu1","0.0~git20170627.0.6353ef0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-4ubuntu0.1"}]}],"versions":["0.3.2-3","0.3.2-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-1"}]}],"versions":["0.3.6-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20170627.0.6353ef0-1ubuntu2.1"}]}],"versions":["0.0~git20170627.0.6353ef0-1ubuntu1","0.0~git20170627.0.6353ef0-1ubuntu2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-4ubuntu0.1"}]}],"versions":["0.3.2-3","0.3.2-4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-golang-x-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-1ubuntu0.20.04.1"}]}],"versions":["0.3.6-1","0.3.7-1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gitleaks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"golang","product":"text"}],"references":[{"url":"https://groups.google.com/g/golang-announce","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f","tags":["x_transferred","Mailing List","Patch","Vendor Advisory","fix","web"]},{"url":"https://deps.dev/advisory/OSV/GO-2021-0113","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pkg.go.dev/golang.org/x/text/language","tags":["x_transferred","Product","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38561","tags":["web","advisory"]},{"url":"https://go.dev/cl/340830","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0113","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ppp9-7jff-5vj2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-38561","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38561","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2023:1649","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11407","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_1649.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38561","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169089","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25725","tags":["advisory"]},{"url":"https://www.haproxy.com/blog/february-2023-header-parser-fixed/","tags":["article"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg43229.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0407","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107392","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0407.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1705","tags":["advisory"]},{"url":"https://go.dev/issue/53188","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://go.dev/issue/53616","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24921","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","tags":["advisory"]},{"url":"https://go.dev/issue/53614","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30629","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30629","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30630","tags":["advisory"]},{"url":"https://go.dev/issue/53415","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","tags":["advisory"]},{"url":"https://go.dev/issue/53168","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","tags":["advisory"]},{"url":"https://go.dev/issue/53416","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","tags":["advisory"]},{"url":"https://go.dev/issue/53611","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","tags":["advisory"]},{"url":"https://go.dev/issue/53615","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32148","tags":["advisory"]},{"url":"https://go.dev/issue/53423","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2021-38561","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5873-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-14040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32149","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32149","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-38561","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T00:00:00Z","modified":"2025-04-14T16:15:14.817Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2022-7707","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T00:00:00Z","modified":"2025-04-14T16:15:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:33.465211Z"}],"ghsa":[{"id":"GHSA-ppp9-7jff-5vj2","title":"golang.org/x/text/language Out-of-bounds Read vulnerability","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:30:22Z","modified":"2023-10-02T11:21:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2021-38561","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10.56Z","modified":"2026-06-17T04:02:21.823Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:07.323379Z"}],"osv":[{"id":"ALPINE-CVE-2021-38561","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10.56Z","modified":"2026-11-03T06:32:58.587298108Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-41221","title":"CVE-2021-38561 affecting package multus for versions less than 4.0.2-1","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10Z","modified":"2026-04-21T04:47:16.592653Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-41469","title":"CVE-2021-38561 affecting package cni for versions less than 1.1.2-2","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-44622","title":"CVE-2021-38561 affecting package podman for versions less than 5.6.1-2","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10Z","modified":"2026-04-21T04:47:16.840911Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44952","title":"CVE-2021-38561 affecting package buildah for versions less than 1.41.4-2","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10Z","modified":"2026-04-21T04:47:31.128928Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-45375","title":"CVE-2021-38561 affecting package containernetworking-plugins for versions less than 1.6.1-4","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10Z","modified":"2026-04-21T04:48:28.165163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CVE-2021-38561","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10.56Z","modified":"2026-10-24T10:30:47.295390749Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-38561","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:10.56Z","modified":"2026-10-23T18:03:50.761358083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-ppp9-7jff-5vj2","title":"golang.org/x/text/language Out-of-bounds Read vulnerability","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:30:22Z","modified":"2026-09-10T03:49:50.331764985Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RHBA-2023:1649","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.35 packages and security update","status":"published","published":"2024-09-30T14:16:00Z","modified":"2026-10-16T10:01:50Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2023:0407","title":"Red Hat Security Advisory: OpenShift Virtualization 4.12.0 RPMs security update","status":"published","published":"2024-09-30T14:30:59Z","modified":"2026-10-20T10:01:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"UBUNTU-CVE-2021-38561","description":"golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.","status":"published","published":"2022-12-26T06:15:00Z","modified":"2026-02-04T04:26:53.122742Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"GO-2021-0113","title":"Out-of-bounds read in golang.org/x/text/language","description":"Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack.","status":"published","published":"2021-10-06T17:51:21Z","modified":"2026-02-04T02:31:07.297346Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"openSUSE-SU-2024:12599-1","title":"cni-1.1.2-2.1 on GA media","description":"These are all security issues fixed in the cni-1.1.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:41.989283Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:14015-1","title":"gitleaks-8.18.3-1.1 on GA media","description":"These are all security issues fixed in the gitleaks-8.18.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:52.32055Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"USN-5873-1","title":"golang-golang-x-text, golang-x-text vulnerabilities","description":"It was discovered that Go Text incorrectly handled certain encodings. An\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14040)\n\nIt was discovered that Go Text incorrectly handled certain BCP 47 language\ntags. An attacker could possibly use this issue to cause a denial of service.\nCVE-2020-28851, CVE-2020-28852 and CVE-2021-38561 affected only\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2020-28851, CVE-2020-28852, CVE-2021-38561, CVE-2022-32149)\n","status":"published","published":"2023-02-16T09:20:08Z","modified":"2026-04-27T16:32:14.263781Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}