Skip to main content
No exploitation reportedFix available

CVE-2021-31525

No exploitation reported by the sources we read.

  • Published2021-05-27
  • Fixed in0.0.0-20210428140749-89ef3d95e781
  • WeaknessCWE-674

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Timeline

dates in UTC
  1. 2021-05-2713:15CVE publishedNVD

Versions per branch

OSV · NVD
golang.org/x/net
BranchAffectedFixed in
0.0< 0.0.0-20210428140749-89ef3d95e7810.0.0-20210428140749-89ef3d95e781
Go
BranchAffectedFixed in
1.16≥ 1.16.0, < 1.16.41.16.4
1.16≥ 1.16.0-0, < 1.16.41.16.4
1.15< 1.15.121.15.12
Fedoraproject fedora
BranchAffectedFixed in
34.x= 34no fix published

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • atomic-openshift-service-idlerRed Hat:openshift:4.7::el8all versions · fixed in 0:4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8
  • cfsslCleanStartall versions · fixed in 1.5.0-r1
  • containernetworking-pluginsRed Hat:openshift:4.8::el7all versions · fixed in 0:0.8.6-3.rhaos4.6.el7and 1 other package
  • cri-oRed Hat:openshift:4.8::el8all versions · fixed in 0:1.21.2-8.rhaos4.8.git8d4264e.el8and 2 other packages
  • cri-oRed Hat:openshift:4.8::el7all versions · fixed in 0:1.21.2-8.rhaos4.8.git8d4264e.el7and 1 other package
  • cri-oRed Hat:openshift:4.7::el8all versions · fixed in 0:1.20.4-7.rhaos4.7.git6287500.el8and 2 other packages
  • cri-oRed Hat:openshift:4.7::el7all versions · fixed in 0:1.20.4-7.rhaos4.7.git6287500.el7and 1 other package
  • cri-toolsRed Hat:openshift:4.8::el8all versions · fixed in 0:1.21.0-3.el8and 2 other packages

60 more package ranges on OSV.dev

Vendor advisories

  • RHSA-2022:0577 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: Windows Container Support for Red Hat OpenShift 5.0.0 [security update]

  • RHSA-2022:0308 Red Hat Product Security6 products fixed

    Red Hat Security Advisory: OpenShift Container Storage 3.11.z security and bug fix update

  • RHSA-2021:4103 Red Hat Product Security6 products fixed

    Red Hat Security Advisory: OpenShift Virtualization 4.9.0 RPMs security and bug fix update

  • RHSA-2021:3748 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: OpenShift Container Storage 3.11.z Container Images Security and Bug Fix Update

  • RHSA-2021:3556 Red Hat Product Security88 products fixed

    Red Hat Security Advisory: Release of OpenShift Serverless 1.17.0

  • RHSA-2021:3555 Red Hat Product Security4 products fixed

    Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.17.0

5 more advisories

Full record on NVD

Fix

  1. Update golang.org/x/net to 0.0.0-20210428140749-89ef3d95e781
  2. Vendor fix Red Hat Product Security RHSA-2022:0577 · 2 productsFor Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html
  3. Vendor fix Red Hat Product Security RHSA-2022:0308 · 6 productsBefore applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
  4. Vendor fix Red Hat Product Security RHSA-2021:4103 · 6 productsFor details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
  5. Vendor fix Red Hat Product Security RHSA-2021:3556 · 88 productsSee the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_containe…
  6. Vendor fix Red Hat Product Security RHBA-2021:2854 · 13 productsBefore applying this update, ensure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 For details on how to install and use MTC, refer to: https://docs.openshift.com/container-pla…
  7. Vendor fix Red Hat Product Security RHSA-2021:2705 · 88 productsSee the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/open…

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

  • NVDCVSS 3.15.9read 2026-10-23
  • NVDCVSS 2.02.6read 2026-10-23
  • NVDweakness (CWE)CWE-674read 2026-10-23
  • FIRST EPSSEPSS score3.7 %2026-11-08
  • OSVaffected packages—
  • GitHub AdvisoriesadvisoryMODERATE2023-02-08

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
2021-05-27
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-h86h-8ppg-mxmh

Frequently asked questions

What is CVE-2021-31525?

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Is CVE-2021-31525 actively exploited?

Active exploitation of CVE-2021-31525 has not been confirmed. Its EPSS score was 3.7% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2021-31525?

CVE-2021-31525 has a CVSS v3 base score of 5.9 (MEDIUM severity), with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Running golang.org/x/net? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record