CVE-2021-33195: golang go

Modified

AliasesUBUNTU-CVE-2021-33195DEBIAN-CVE-2021-33195GO-2021-0239+2 more

Published 02-08-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-33195 is a high (CVSS 7.5) vulnerability in golang go. EPSS estimates a 3.20% chance of exploitation in the next 30 days, higher than 88.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

3.20%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Timeline

02-08-2021
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.3v2.07.5

EPSS trend

Probability

3.20%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.20% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (groups.google.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu2 products

golang-1.16All versions (No fix recorded)
golang-1.8All versions (No fix recorded)

Alpine1 product

go≥ 1.16.0, < 1.15.13-r0 | ≥ 1.16.0, < 1.16.5-r0

Debian1 product

golang-1.15< 1.15.9-5

Go1 product

stdlib≥ 1.16.0-0, < 1.16.5

Golang1 product

go< 1.15.13 | ≥ 1.16.0, < 1.16.5

Netapp1 product

cloud_insights_telegraf_agentna

6 vendors · 7 products

References

13 links

groups.google.com/g/golang-announceX Refsource MISCThird Party Advisory
groups.google.com/g/golang-announce/c/RgCMkAEQjSIX Refsource MISCREPORTWEBExploitPatchThird Party Advisory
security.netapp.com/advisory/ntap-20210902-0005/X Refsource CONFIRMThird Party Advisory
security.gentoo.org/glsa/202208-02Vendor AdvisoryX Refsource GENTOOThird Party Advisory
ubuntu.com/security/CVE-2021-33195REPORT
github.com/golang/go/issues/46241REPORT
www.cve.org/CVERecord?id=CVE-2021-33195REPORT
security-tracker.debian.org/tracker/CVE-2021-33195Advisory
go.dev/cl/320949FIX
go.googlesource.com/go/+/c89f1224a544cde464fcb86e78ebb0cc97eedba2FIX

Show all 13 references

go.dev/issue/46241REPORT
nvd.nist.gov/vuln/detail/CVE-2021-33195OvalAdvisory
security.alpinelinux.org/vuln/CVE-2021-33195Advisory