Skip to content
Fencer Intel
medium 5.9

CVE-2021-31525 json

golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

published 5y ago modified last mo. also BIT-golang-2021-31525 , EUVD-2022-4104 , GHSA-h86h-8ppg-mxmh , GO-2022-0236

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.7%
EPSS 3.7% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Patch / fix

  • go golang.org/x/net 0.0.0-20210428140749-89ef3d95e781
  • bitnami golang 1.15.12, 1.16.4
  • go stdlib 1.15.12, 1.16.4
  • golang go 1.15.12, 1.16.4
  • golang-golang-x-net Debian 14, Debian 13, Debian 12 1:0.0+git20210119.5f4716e+dfsg-3

debian advisories DEBIAN-CVE-2021-31525

  • delve RHEL 8 1.5.0-2.module+el8.4.0+8864+58b0fcdb
  • golang RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • go-toolset RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-bin RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-src RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-misc RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-race RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-tests RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8

red hat advisories RHSA-2021:3076RHSA-2021:3555RHSA-2021:2984RHSA-2021:2704RHSA-2021:5072RHSA-2021:3487

  • go1.16 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.16.4-1.14.2
  • go1.15 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.15.12-1.30.1

suse advisories SUSE-SU-2021:2085-1SUSE-SU-2021:2082-1

  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.16 openSUSE Tumbleweed 1.16.8-1.1
  • go1.15 openSUSE Leap 15.2 1.15.12-lp152.17.1

opensuse advisories openSUSE-SU-2024:10808-1openSUSE-SU-2024:10809-1openSUSE-SU-2021:0904-1

  • delve Rocky Linux 8 1.5.0-2.module+el8.4.0+396+d2d16ae3
  • golang Rocky Linux 8 1.15.14-1.module+el8.4.0+632+4dba2916
  • go-toolset Rocky Linux 8 1.15.14-1.module+el8.4.0+632+4dba2916

rocky linux advisories RLSA-2021:3076

  • go Alpine 3.13 1.15.12-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.4-r0

alpine advisories ALPINE-CVE-2021-31525

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.16.4-1

arch linux advisories AVG-1927

Is CVE-2021-31525 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-31525 updated cvss 5.9

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operator, rhmtc/openshift-migration-velero-plugin-for-mtc-r hel Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-operator, +4 more
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Enterprise Linux 7 golang, buildah, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 buildah, buildah-tests
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator
    affected: no fix available
  • Red Hat OpenShift Virtualization 2 kubevirt, virt-api-container, kubemacpool-container, virt-handler-container, bridge-marker-container, virt-launcher-container, +24 more
    affected: no fix available “Fix deferred”
  • Red Hat Storage 3 etcd, golang, grafana, golang-bin, golang-src, golang-misc, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat CNV 2.6 for RHEL 8 container-native-virtualization/vm-import-controller v2.6.7-5, container-native-virtualization/kubevirt-cpu-node-labeller v2.6.7-1, container-native-virtualization/vm-import-controller-rhel8 v2.6.7-5, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.6.7-1, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.6.7-1
    fixed: vendor fix RHSA-2021:3733
show 17 more
  • Red Hat CNV 4.9 for RHEL 7 kubevirt 4.9.0-287.el7, kubevirt-virtctl 4.9.0-287.el7, kubevirt-virtctl-redistributable 4.9.0-287.el7 Red Hat CNV 4.9 for RHEL 8 kubevirt 4.9.0-287.el8, kubevirt-virtctl 4.9.0-287.el8, kubevirt-virtctl-redistributable 4.9.0-287.el8, container-native-virtualization/virt-api v4.9.0-61, container-native-virtualization/kubemacpool v4.9.0-19, container-native-virtualization/virt-handler v4.9.0-61, +25 more
    fixed: vendor fix RHSA-2021:4103
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.5.0-2.module+el8.4.0+8864+58b0fcdb, golang 1.15.14-1.module+el8.4.0+11833+614b07b8, go-toolset 1.15.14-1.module+el8.4.0+11833+614b07b8, golang-bin 1.15.14-1.module+el8.4.0+11833+614b07b8, golang-src 1.15.14-1.module+el8.4.0+11833+614b07b8, golang-misc 1.15.14-1.module+el8.4.0+11833+614b07b8, +2 more
    fixed: vendor fix RHSA-2021:3076
  • Red Hat Gluster Storage Server 3.5 on RHEL-7 heketi 10.4.0-2.el7rhgs, heketi-client 10.4.0-2.el7rhgs, python-heketi 10.4.0-2.el7rhgs, rhgs3/rhgs-gluster-block-prov-rhel7 3.11.8-1
    fixed: vendor fix RHSA-2022:0308
  • Red Hat Migration Toolkit 1.4 rhmtc/openshift-migration-ui-rhel8 v1.4.6-4, rhmtc/openshift-velero-plugin-rhel8 v1.4.6-4, rhmtc/openshift-migration-velero-rhel8 v1.4.6-5, rhmtc/openshift-migration-registry-rhel8 v1.4.6-4, rhmtc/openshift-migration-operator-bundle v1.4.6-5, rhmtc/openshift-migration-controller-rhel8 v1.4.6-4, +7 more
    fixed: vendor fix RHBA-2021:2854
  • Red Hat OpenShift Container Platform 4.7 ignition 2.9.0-4.rhaos4.7.git1d56dc8.el8, ignition-validate 2.9.0-4.rhaos4.7.git1d56dc8.el8
    fixed: vendor fix RHBA-2021:2979
  • Red Hat OpenShift Container Platform 4.8 cri-tools 1.21.0-3.el8, ignition 2.9.0-7.rhaos4.8.el8, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-validate 2.9.0-7.rhaos4.8.el8, prometheus-promu 0.5.0-4.git642a960.el8, +137 more
    fixed: vendor fix RHSA-2021:3248
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-etcd v4.9.0-202109302317.p0.git.5c1feaf.assembly.stream
    fixed: vendor fix RHSA-2021:3759
  • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator 5.0.0-5, openshift4-wincw/windows-machine-config-operator-bundle v5.0.0-5
    fixed: vendor fix RHSA-2022:0577
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.4-18, distributed-tracing/jaeger-query-rhel8 1.20.4-18, distributed-tracing/jaeger-ingester-rhel8 1.20.4-17, distributed-tracing/jaeger-rhel8-operator 1.20.4-18, distributed-tracing/jaeger-collector-rhel8 1.20.4-18, distributed-tracing/jaeger-all-in-one-rhel8 1.20.4-18, +2 more
    fixed: vendor fix RHSA-2021:2543
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.22.0-3.el8, openshift-serverless-clients 0.23.2-1.el8
    fixed: vendor fix RHSA-2021:2704
  • Red Hat OpenShift Serverless 1.16 openshift-serverless-1/client-kn-rhel8 0.22.0-4, openshift-serverless-1/serving-queue-rhel8 0.22.0-4, openshift-serverless-1/eventing-mtping-rhel8 0.22.0-2, openshift-serverless-1/kourier-control-rhel8 0.22.0-2, openshift-serverless-1/serving-webhook-rhel8 0.22.0-3, openshift-serverless-1/eventing-webhook-rhel8 0.22.0-2, +24 more
    fixed: vendor fix RHSA-2021:2705
  • Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8 0.23.2-2, openshift-serverless-1/serving-queue-rhel8 0.23.1-2, openshift-serverless-1/eventing-mtping-rhel8 0.23.0-5, openshift-serverless-1/kourier-control-rhel8 0.23.0-4, openshift-serverless-1/serving-webhook-rhel8 0.23.1-2, openshift-serverless-1/eventing-webhook-rhel8 0.23.0-5, +24 more
    fixed: vendor fix RHSA-2021:3556
  • Red Hat OpenStack Platform 16.1 etcd 3.3.23-3.1.el8ost.1
    fixed: vendor fix RHSA-2021:5072
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-3.1.el8ost.1
    fixed: vendor fix RHSA-2021:3487
  • Red Hat Storage Native Client for Red Hat Enterprise Linux 7 heketi 10.4.0-2.el7rhgs, heketi-client 10.4.0-2.el7rhgs
    fixed: vendor fix RHSA-2022:0308
  • Red Hat RHACS 3.62 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator 3.62.0-4
    fixed: vendor fix RHEA-2021:2679
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-api v4.9.2-7, container-native-virtualization/virtio-win v4.9.0-8, container-native-virtualization/virtio-win v4.9.2-1, container-native-virtualization/kubemacpool v4.9.2-1, container-native-virtualization/virt-handler v4.9.2-7, container-native-virtualization/bridge-marker v4.9.2-1, +40 more Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 9 golang, buildah, go-toolset, golang-bin, golang-src, golang-misc, +3 more Red Hat Gluster Storage Server 3.5 on RHEL-7 rhgs3/rhgs-server-rhel7 3.11.8-3, rhgs3/rhgs-volmanager-rhel7 3.11.8-3 Red Hat OpenShift Container Platform 4.7 redhat-release-coreos 47.84-1.el8, cri-o 1.20.4-7.rhaos4.7.git6287500.el7, cri-o 1.20.4-7.rhaos4.7.git6287500.el8, openshift 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, openshift 4.7.0-202107292242.p0.git.558d959.assembly.stream.el8, openshift-kuryr 4.7.0-202107291238.p0.git.c7654fb.assembly.stream.el8, +13 more Red Hat OpenShift Container Platform 4.8 cri-o 1.21.2-13.rhaos4.8.git52b3f98.el7, cri-o 1.21.2-13.rhaos4.8.git52b3f98.el8, openstack-ironic 17.0.4-0.20210730151213.5b801be.el8, openstack-ironic-api 17.0.4-0.20210730151213.5b801be.el8, python3-ironic-tests 17.0.4-0.20210730151213.5b801be.el8, openstack-ironic-common 17.0.4-0.20210730151213.5b801be.el8, +22 more
    +4 more products
    Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202109302317.p0.git.96e95ce.assembly.stream, openshift4/ose-pod v4.9.0-202110080828.p0.git.894a78b.assembly.stream, openshift4/ose-console v4.9.0-202110130449.p0.git.8c077e4.assembly.rc.8, openshift4/ose-tests v4.9.0-202110011028.p0.git.6105395.assembly.stream, openshift4/ose-coredns v4.9.0-202109302317.p0.git.3cb11c0.assembly.stream, openshift4/ose-grafana v4.9.0-202109302317.p0.git.6130ba8.assembly.stream, +141 more Red Hat Openshift Container Storage 4 ocs4/ocs-must-gather-rhel8 Red Hat OpenShift Virtualization 2 vm-import-virtv2v-container Red Hat RHACS 3.62 for RHEL 8 advanced-cluster-security/rhacs-operator-bundle 3.62.0-4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.69% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/net
<0.0.0-20210428140749-89ef3d95e781
0.0.0-20210428140749-89ef3d95e781
bitnami golang
<1.15.12
>=1.16.0, <1.16.4
1.15.12
1.16.4
go stdlib
<1.15.12
>=1.16.0-0, <1.16.4
1.15.12
1.16.4

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.