net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-srcUpgrade golang-raceUpgrade go-toolsetUpgrade golang-miscUpgrade golangUpgrade golang-docsUpgrade golang-testsUpgrade golang-bin | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | May 27, 2021 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golang-miscUpgrade golang-binUpgrade golangUpgrade golang-raceUpgrade golang-testsUpgrade golang-docs | Jun 24, 2021 | May 27, 2021 |
| Amazon_linux | — | Upgrade golang | Jul 13, 2021 | May 27, 2021 |
| Centos_linux | — | Upgrade go-toolsetUpgrade heketi-clientUpgrade golang-testsUpgrade delve-debuginfoUpgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade delve-debugsourceUpgrade delveUpgrade golang-binUpgrade golang-raceUpgrade golang-docs | Aug 12, 2021 | May 27, 2021 |
| Debian | — | Upgrade golang-1.15Upgrade golang-golang-x-net | Jul 30, 2024 | May 27, 2021 |
| Freebsd | — | Upgrade go | Nov 4, 2022 | May 6, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | May 27, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Sep 29, 2021 | May 27, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Sep 24, 2021 | May 27, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Sep 29, 2021 | May 27, 2021 |
| Oracle_linux | — | Upgrade go-toolsetUpgrade delveUpgrade golang-raceUpgrade golang-testsUpgrade golangUpgrade golang-binUpgrade golang-miscUpgrade golang-docsUpgrade golang-src | Aug 12, 2021 | Apr 22, 2021 |
| Redhat Openshift | — | Upgrade openshift4-wincw/windows-machine-config-rhel8-operatorUpgrade cri-oUpgrade golang-github-prometheus-promuUpgrade cri-toolsUpgrade containernetworking-pluginsUpgrade openshift-clientsUpgrade ignitionUpgrade openshift | Aug 12, 2021 | May 27, 2021 |
| Redhat_linux | — | Upgrade delve-debuginfoUpgrade golang-miscUpgrade go-toolsetUpgrade golangUpgrade golang-raceUpgrade golang-srcUpgrade delveUpgrade delve-debugsourceUpgrade golang-binNo solution existsUpgrade golang-docsUpgrade golang-tests | Aug 12, 2021 | May 27, 2021 |
| Rocky_linux | — | Upgrade golangUpgrade go-toolsetUpgrade delve-debuginfoUpgrade golang-raceUpgrade delve-debugsourceUpgrade delveUpgrade golang-bin | Mar 12, 2024 | May 27, 2021 |
| Suse | — | Upgrade go1.15Upgrade go1.15-docUpgrade go1.16Upgrade go1.16-raceUpgrade go1.15-raceUpgrade go1.16-doc | Jun 19, 2021 | May 27, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub