Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Priority LOW 39CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Why it matters now
EPSS 0.03859 90th percentileScored 2026-11-07
Fix Partial Red Hat: 20 advisoriesRed Hat: 13 fixed, 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.14.12; 1.15 to before 1.15.5 | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.14.12; 1.15 to before 1.15.5 Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:trident:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 20 advisories
- RHSA-2021:2543 Released 2021-06-24 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.20.4 security update
- Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +5
- RHSA-2021:2532 Released 2021-06-23 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.17.9 security update
- Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +3
- RHSA-2021:1551 Released 2021-05-19 · Red Hat rating ModerateOpenShift Container Platform 4.7.11 security and bug fix update
- Red Hat OpenShift Container Platform 4.7 cri-tools-1.20.0-2.el7, cri-tools-1.20.0-2.el8, jenkins-2.277.3.1620393611-1.el8 +2
Show 17 more Red Hat advisories
- RHSA-2021:2042 Released 2021-05-19 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.7 RPM security, bug fix, and enhancement update
- Red Hat OpenShift Container Storage 4.7 on RHEL-8 mcg-5.7.0-69.85e2026.5.7.el8
- RHSA-2021:2041 Released 2021-05-19 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
- Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator
- RHSA-2021:1366 Released 2021-05-04 · Red Hat rating ModerateOpenShift Container Platform 4.7.9 packages and security update
- Red Hat OpenShift Container Platform 4.7 golang-github-prometheus-promu-0.5.0-3.git642a960.el8, prometheus-promu-0.5.0-3.git642a960.el8
- RHSA-2021:0956 Released 2021-03-30 · Red Hat rating LowOpenShift Container Platform 4.6.23 security update
- Red Hat OpenShift Container Platform 4.6 openshift-eventrouter-0.2-6.git7c289cc.el8
- RHSA-2021:0799 Released 2021-03-10 · Red Hat rating ModerateOpenShift Virtualization 2.6.0 security and bug fix update
- CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
- RHSA-2021:0706 Released 2021-03-02 · Red Hat rating Importantcontainer-tools:2.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.aarch64::container-tools:2.0, buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.ppc64le::container-tools:2.0, buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.s390x::container-tools:2.0 +47
- RHSA-2020:5634 Released 2021-02-24 · Red Hat rating ModerateOpenShift Container Platform 4.7.0 packages security update
- Red Hat OpenShift Container Platform 4.7 cri-o-1.20.0-0.rhaos4.7.git8921e00.el7.51, cri-o-1.20.0-0.rhaos4.7.git8921e00.el8.51, cri-tools-1.18.0-3.el7 +9
- RHSA-2021:0568 Released 2021-02-16 · Red Hat rating ModerateOpenShift Container Platform 4.6 file-integrity-operator image security update
- Red Hat OpenShift Container Platform 4.6 openshift4/file-integrity-rhel8-operator
- RHSA-2021:0436 Released 2021-02-16 · Red Hat rating ModerateOpenShift Container Platform 4.6 compliance-operator security and bug fix update
- Red Hat OpenShift Container Platform 4.6 openshift4/compliance-rhel8-operator
- RHSA-2021:0172 Released 2021-01-25 · Red Hat rating ModerateOpenShift Container Platform 4.6.13 packages and security update
- Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-3.rhaos4.6.el8, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el7, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el8 +4
- RHSA-2021:0037 Released 2021-01-18 · Red Hat rating ModerateOpenShift Container Platform 4.6.12 bug fix and security update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8-operator, openshift4/ose-aws-machine-controllers +47
- RHSA-2021:0039 Released 2021-01-18 · Red Hat rating ModerateOpenShift Container Platform 4.6.12 extras and security update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-ansible-operator, openshift4/ose-cluster-capacity, openshift4/ose-cluster-kube-descheduler-operator +27
- RHSA-2021:0038 Released 2021-01-18 · Red Hat rating ImportantOpenShift Container Platform 4.6.12 packages and security update
- Red Hat OpenShift Container Platform 4.6 cri-o-1.19.1-2.rhaos4.6.git2af9ecf.el8, jenkins-2-plugins-4.6.1608634578-1.el7, jenkins-2-plugins-4.6.1609853716-1.el8 +8
- RHSA-2021:0146 Released 2021-01-14 · Red Hat rating ModerateRelease of OpenShift Serverless 1.12.0
- Openshift Serverless 1.12 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +23
- RHSA-2021:0145 Released 2021-01-14 · Red Hat rating ModerateRed Hat OpenShift Serverless Client kn 1.12.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.18.4-2.el8
- RHSA-2020:5493 Released 2020-12-15 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.4.1-1.module+el8.3.0+7840+63dfb1ed.src::go-toolset:rhel8, delve-1.4.1-1.module+el8.3.0+7840+63dfb1ed.x86_64::go-toolset:rhel8, go-toolset-1.14.12-1.module+el8.3.0+8784+380394dc.aarch64::go-toolset:rhel8 +18
- RHSA-2020:5333 Released 2020-12-03 · Red Hat rating Moderatego-toolset-1.14-golang security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.14-1.14.12-1.el7_9, go-toolset-1.14-build-1.14.12-1.el7_9, go-toolset-1.14-golang-1.14.12-1.el7_9 +7
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.14-1.14.12-1.el7_9, go-toolset-1.14-build-1.14.12-1.el7_9, go-toolset-1.14-golang-1.14.12-1.el7_9 +7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| CNV 2.6 for RHEL 8 | Fixed | RHSA-2021:0799 |
| OpenShift Service Mesh 2.0 | Fixed | — |
| Openshift Serverless 1.12 | Fixed | RHSA-2021:0146 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:5333 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:5333 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:5493, RHSA-2021:0706 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:0037, RHSA-2021:0038, RHSA-2021:0039, RHSA-2021:0172, RHSA-2021:0436, RHSA-2021:0568, RHSA-2021:0956 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2020:5633, RHSA-2020:5634, RHSA-2021:1366, RHSA-2021:1551 |
| Red Hat OpenShift Container Storage 4.6 on RHEL-8 | Fixed | — |
| Red Hat OpenShift Container Storage 4.7 on RHEL-8 | Fixed | RHSA-2021:2041, RHSA-2021:2042 |
| Red Hat OpenShift Jaeger 1.17 | Fixed | RHSA-2021:2532 |
| Red Hat OpenShift Jaeger 1.20 | Fixed | RHSA-2021:2543 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:0145 |
Not affected: 16 products
- Distributed Tracing Jaeger 1
- OpenShift Service Mesh 2.0
- Red Hat Ceph Storage 3
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Storage 4.6 on RHEL-8
- Red Hat OpenShift Container Storage 4.7 on RHEL-8
- Red Hat OpenShift Jaeger 1.17
- Red Hat OpenShift Jaeger 1.20
- Red Hat OpenShift Virtualization 2
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28362
- 2026-10-03 Alias added: GHSA-gff4-9rfx-4pcw
- 2026-10-14 EPSS moved to the 90th–95th percentile
References
Advisory 5
Sources
- CVE-2020-28362 · CVE Program
- CVE-2020-28362 · NVD
- FIRST EPSS
- GHSA-gff4-9rfx-4pcw · GitHub Advisory Database · CC BY 4.0
- CVE-2020-28362 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences