CVE-2021-38561

Aliases:GHSA-ppp9-7jff-5vj2GO-2021-0113DEBIAN-CVE-2021-38561CGA-2626-3wmq-9vqgCGA-3v8r-jh9x-rxv8CGA-4pf3-p5xj-m643CGA-5h9m-fcqr-c2r6CGA-642c-phqv-vf86CGA-8gcp-c4xc-3583CGA-8h42-ww3m-7xrgCGA-8j29-h6w9-x96hCGA-9cw5-qj35-4w34CGA-9v39-wf7p-4h4wCGA-ggvf-p3fw-3p2vCGA-j4p2-g23f-5mqxCGA-jrgp-j2r2-cvvgCGA-p3mw-xxwg-xx79CGA-8p46-8mpr-mf5fCGA-94qq-h9xr-45x9CGA-9g34-cwgc-v493CGA-cv7v-7m7v-6q3mCGA-hgmw-rmvc-cw8cCGA-hrj3-gw99-95hhCGA-mjf8-h6ww-qf29CGA-v48v-368r-m557CGA-w2pc-vrfc-3mghCGA-x6c7-7f9v-hm79
Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 26 Dec 2022, 00:00
Last modified:14 Apr 2025, 16:15

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.36% LOW
1% probability +1.30%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Dec 2022, 00:00
Published
Vulnerability first disclosed
14 Apr 2025, 16:15
Last Modified
Vulnerability information updated

Description

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.36%• Percentile: 70%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • chainguard•dex-k8s-authenticator

    < 0

  • chainguard•dynamic-localpv-provisioner

    < 3.4.1-r3

  • chainguard•dynamic-localpv-provisioner-fips

    < 3.5.0-r0

  • chainguard•gitleaks

    < 8.18.2-r1

  • chainguard•hey

    < 0.1.4-r3

  • chainguard•k3d

    < 5.6.0-r11

  • chainguard•k3d-proxy

    < 5.6.0-r11

  • chainguard•k3d-tools

    < 5.6.0-r11

  • chainguard•prometheus-postgres-exporter-0.10

    < 0

  • chainguard•terraform-provider-sendgrid

    < 1.0.1-r1

  • chainguard•terraform-provider-sendgrid-fips

    < 1.0.1-r1

  • chainguard•vt-cli

    < 1.0.0-r3

  • wolfi•dynamic-localpv-provisioner

    < 3.4.1-r3

  • wolfi•gitleaks

    < 8.18.2-r1

  • wolfi•hey

    < 0.1.4-r3

  • wolfi•k3d

    < 5.6.0-r11

  • wolfi•k3d-proxy

    < 5.6.0-r11

  • wolfi•k3d-tools

    < 5.6.0-r11

  • wolfi•terraform-provider-sendgrid

    < 1.0.1-r1

  • wolfi•vt-cli

    < 1.0.0-r3

  • debian•golang-golang-x-text

    all | < 0.3.7-1 | < 0.3.7-1 | < 0.3.7-1

  • golang.org/x•text

    < 0.3.7

  • golang•text

    < 0.3.7

References (8)