CVE-2021-36221: Race Condition
A race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Reference:
https://github.com/golang/go/issues/46866
Other sources
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
— MITRE
Golang Go is vulnerable to a denial of service, caused by a race condition upon an ErrAbortHandler abort. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a net/http/httputil ReverseProxy panic.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-36221?
CVE-2021-36221 is a vulnerability in Golang Go that can lead to a denial of service by exploiting a race condition in net/http/httputil ReverseProxy.
How does CVE-2021-36221 impact Golang Go?
CVE-2021-36221 can be exploited by a remote attacker to cause a panic in net/http/httputil ReverseProxy, resulting in a denial of service.
What is the severity of CVE-2021-36221?
The severity of CVE-2021-36221 is rated as high with a CVSS score of 7.5.
Which versions of Golang Go are affected by CVE-2021-36221?
Golang Go versions 1.15.15 and 1.16.0 to 1.16.7 are affected by CVE-2021-36221.
How can I fix CVE-2021-36221 in Golang Go?
To fix CVE-2021-36221, update Golang Go to version 1.15.15 or 1.16.7.