Skip to content
Fencer Intel
medium 5.5

CVE-2021-27919 json

Panic when opening archives in archive/zip

published 5y ago modified 2mo ago also BIT-golang-2021-27919 , EUVD-2021-14642 , GO-2021-0067

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.

Patch / fix

  • bitnami golang 1.16.1
  • go stdlib 1.16.1
  • golang go 1.16.1
  • go1.16 SLE Module for Development Tools 15 SP2 1.16.2-1.8.1

suse advisories SUSE-SU-2021:0937-1

  • go1.16 openSUSE Tumbleweed 1.16.8-1.1

opensuse advisories openSUSE-SU-2024:10809-1

  • go Alpine 3.13 1.15.10-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.2-r0

alpine advisories ALPINE-CVE-2021-27919

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.16.1-1

arch linux advisories AVG-1668

Is CVE-2021-27919 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-27919 updated cvss 5.5

golang: archive/zip: panic when calling Reader.Open

  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Serverless cli, knative-serving knative-serving, knative-eventing knative-eventing Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-pilot-agent, +2 more Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, golang, libgcc, +20 more Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more
    +5 more products
    Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift4/ose-cli, openshift-hyperkube, openshift4/ose-console, +10 more Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8, ocs4/rook-ceph-rhel8-operator Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.52% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
>=1.16.0, <1.16.1
1.16.1
go stdlib
>=1.16.0-0, <1.16.1
1.16.1

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.