cve.bz

CVE-2021-31525

5.9 mediumEPSS 3.7%

Medium (5.9). EPSS 3.7% chance of exploitation in the next 30 days. Fixed in golang.org/x/net 0.0.0-20210428140749-89ef3d95e781.

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Severity

CVSS 3.1

5.9 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE
CWE-674
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-h86h-8ppg-mxmhGogolang.org/x/net<0.0.0-20210428140749-89ef3d95e7810.0.0-20210428140749-89ef3d95e781
GO-2022-0236Gostdlib<1.15.12
>=1.16.0-0 <1.16.4		1.15.12, 1.16.4
GO-2022-0236Gogolang.org/x/net<0.0.0-20210428140749-89ef3d95e7810.0.0-20210428140749-89ef3d95e781

References

Check your stackJSON