Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as…
Priority LOW 32CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 17 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
Why it matters now
EPSS 0.02883 86th percentileScored 2026-11-07
Fix Partial Red Hat: 19 advisoriesRed Hat: 17 fixed, 10 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.13.13; 1.14.0 to before 1.14.5 | Vulnerable | Go standard library |
| cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* | before 13.7.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:* | before 0.203.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.13.13; 1.14.0 to before 1.14.5 Vulnerable ·Go standard library
- cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* Versions before 13.7.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:* Versions before 0.203.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
Remediation
Red Hat 19 advisories
- RHSA-2021:4103 Released 2021-11-02 · Red Hat rating ModerateOpenShift Virtualization 4.9.0 RPMs security and bug fix update
- CNV 4.9 for RHEL 7 kubevirt-4.9.0-287.el7, kubevirt-virtctl-4.9.0-287.el7, kubevirt-virtctl-redistributable-4.9.0-287.el7
- CNV 4.9 for RHEL 8 kubevirt-4.9.0-287.el8, kubevirt-virtctl-4.9.0-287.el8, kubevirt-virtctl-redistributable-4.9.0-287.el8
- RHSA-2021:2122 Released 2021-06-01 · Red Hat rating ImportantOpenShift Container Platform 4.7.13 packages and security update
- Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o-1.20.2-12.rhaos4.7.git9f7be76.el8, cri-tools-1.20.0-3.el7 +2
- RHSA-2021:1515 Released 2021-05-06 · Red Hat rating ImportantOpenshift Logging Bug Fix Release (5.0.3)
- OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
Show 16 more Red Hat advisories
- RHSA-2021:1366 Released 2021-05-04 · Red Hat rating ModerateOpenShift Container Platform 4.7.9 packages and security update
- Red Hat OpenShift Container Platform 4.7 golang-github-prometheus-promu-0.5.0-3.git642a960.el8, prometheus-promu-0.5.0-3.git642a960.el8
- RHSA-2021:1016 Released 2021-04-13 · Red Hat rating LowOpenShift Container Platform 4.5.37 security update
- Red Hat OpenShift Container Platform 4.5 containers-common-1:1.1.1-2.rhaos4.5.el8, ignition-0.35.1-12.rhaos4.5.gitb4d18ad.el8, ignition-validate-0.35.1-12.rhaos4.5.gitb4d18ad.el8 +8
- RHSA-2021:0956 Released 2021-03-30 · Red Hat rating LowOpenShift Container Platform 4.6.23 security update
- Red Hat OpenShift Container Platform 4.6 openshift-eventrouter-0.2-6.git7c289cc.el8
- RHSA-2021:0713 Released 2021-03-11 · Red Hat rating LowOpenShift Container Platform 4.5.34 packages and security update
- Red Hat OpenShift Container Platform 4.5 apb-2.0.3-3.el7, apb-container-scripts-2.0.3-3.el7, apb-devel-2.0.3-3.el7 +14
- RHSA-2021:0799 Released 2021-03-10 · Red Hat rating ModerateOpenShift Virtualization 2.6.0 security and bug fix update
- CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
- RHSA-2021:0172 Released 2021-01-25 · Red Hat rating ModerateOpenShift Container Platform 4.6.13 packages and security update
- Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-3.rhaos4.6.el8, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el7, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el8 +4
- RHSA-2021:0072 Released 2021-01-11 · Red Hat rating ModerateOpenShift Serverless 1.9.0 release and security update
- OpenShift Serverless 1.9.0
- RHSA-2020:5649 Released 2020-12-22 · Red Hat rating LowRed Hat OpenShift Service Mesh 1.1.11 security update
- OpenShift Service Mesh 1.1 ior-1.1.11-2.el8, servicemesh-1.1.11-2.el8, servicemesh-citadel-1.1.11-2.el8 +12
- RHSA-2020:5605 Released 2020-12-17 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.6.0 security, bug fix, enhancement update
- Red Hat OpenShift Container Storage 4.6 on RHEL-8 ocs4/cephcsi-rhel8, ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator +3
- RHSA-2020:5606 Released 2020-12-17 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.6 bug fix and enhancement update
- Red Hat OpenShift Container Storage 4.6 on RHEL-8 mcg-5.6.0-39.2279a46.5.6.el8
- RHSA-2020:5118 Released 2020-11-24 · Red Hat rating ModerateOpenShift Container Platform 4.5.20 bug fix and golang security update
- Red Hat OpenShift Container Platform 4.5 openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers, openshift4/ose-baremetal-machine-controllers +47
- RHSA-2020:5119 Released 2020-11-24 · Red Hat rating ModerateOpenShift Container Platform 4.5.20 packages and golang security update
- Red Hat OpenShift Container Platform 4.5 cri-o-1.18.4-4.rhaos4.5.git6dee389.el7, cri-o-1.18.4-4.rhaos4.5.git6dee389.el8
- RHSA-2020:4297 Released 2020-10-27 · Red Hat rating ModerateOpenShift Container Platform 4.6.1 package security update
- Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-2.rhaos4.6.el8, jenkins-2-plugins-4.6.1601368321-1.el8, openshift-clients-4.6.0-202010081244.p0.git.3794.4743d24.el7 +11
- RHSA-2020:4214 Released 2020-10-08 · Red Hat rating Moderatego-toolset-1.13-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.13-1.13.15-1.el7, go-toolset-1.13-build-1.13.15-1.el7, go-toolset-1.13-golang-1.13.15-3.el7 +7
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.13-1.13.15-1.el7, go-toolset-1.13-build-1.13.15-1.el7, go-toolset-1.13-golang-1.13.15-3.el7 +7
- RHSA-2020:4201 Released 2020-10-06 · Red Hat rating LowOpenShift Virtualization 2.4.2 Images
- CNV 2.4 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +1
- RHSA-2020:3665 Released 2020-09-08 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.3.2-3.module+el8.2.0+5581+896cb53e.src::go-toolset:rhel8, delve-1.3.2-3.module+el8.2.0+5581+896cb53e.x86_64::go-toolset:rhel8, go-toolset-1.13.15-1.module+el8.2.0+7662+fa98b974.aarch64::go-toolset:rhel8 +18
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| CNV 2.4 for RHEL 8 | Fixed | RHSA-2020:4201 |
| CNV 4.9 for RHEL 7 | Fixed | RHSA-2021:4103 |
| CNV 4.9 for RHEL 8 | Fixed | RHSA-2021:4103 |
| OpenShift Logging 5.0 | Fixed | RHSA-2021:1515 |
| OpenShift Serverless 1.9.0 | Fixed | RHSA-2021:0072 |
| OpenShift Service Mesh 1.0 | Fixed | — |
| OpenShift Service Mesh 1.1 | Fixed | RHSA-2020:5649 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4214 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4214 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:3665 |
| Red Hat OpenShift Container Platform 4.4 | Fixed | — |
| Red Hat OpenShift Container Platform 4.5 | Fixed | RHSA-2020:5118, RHSA-2020:5119, RHSA-2021:0713, RHSA-2021:1016 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2020:4297, RHSA-2021:0172, RHSA-2021:0956 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2021:1366, RHSA-2021:2122 |
| Red Hat OpenShift Container Storage 4.6 on RHEL-8 | Fixed | RHSA-2020:5605, RHSA-2020:5606 |
| Red Hat OpenShift Jaeger 1.17 | Fixed | — |
| Red Hat OpenShift Jaeger 1.20 | Fixed | — |
Not affected: 8 products
- OpenShift Logging 5.0
- Red Hat OpenShift Container Platform 4.4
- Red Hat OpenShift Container Platform 4.5
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.6 for System Z over RHEL 8
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Storage 4.6 on RHEL-8
- Red Hat OpenShift Virtualization 2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15586
- 2026-10-03 Alias added: GHSA-9rmg-8r3f-xrq7
References
Advisory 11
- openSUSE-SU-2020:1087
- openSUSE-SU-2020:1095
- FEDORA-2020-d75360e2b0
- FEDORA-2020-9cd1204ba0
- openSUSE-SU-2020:1405
- openSUSE-SU-2020:1407
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update
- DSA-4848
- https://security.netapp.com/advisory/ntap-20200731-0005/
- https://www.cloudfoundry.org/blog/cve-2020-15586/
Sources
- CVE-2020-15586 · CVE Program
- CVE-2020-15586 · NVD
- FIRST EPSS
- GHSA-9rmg-8r3f-xrq7 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-15586 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences