encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a…
Priority LOW 38CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 12 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-835.
Summary
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
Why it matters now
EPSS 0.02474 84th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 5 fixed, 12 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.15.9; 1.16.0 to before 1.16.1 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.15.9; 1.16.0 to before 1.16.1 Vulnerable ·Go standard library
Remediation
Red Hat 5 advisories
- RHSA-2021:3556 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless 1.17.0
- Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:3555 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.17.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.23.2-1.el8
- RHSA-2021:3076 Released 2021-08-10 · Red Hat rating Moderatego-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-1.module+el8.4.0+11833+614b07b8.aarch64::go-toolset:rhel8 +18
Show 2 more Red Hat advisories
- RHSA-2021:2705 Released 2021-07-13 · Red Hat rating ModerateRelease of OpenShift Serverless 1.16.0
- Red Hat OpenShift Serverless 1.16 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:2704 Released 2021-07-13 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.16.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.22.0-3.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Distributed Tracing Jaeger 1 | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2.0 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3076 |
| Red Hat OpenShift Container Storage 4.8 on RHEL-8 | Fixed | — |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:2704, RHSA-2021:3555 |
| Red Hat OpenShift Serverless 1.16 | Fixed | RHSA-2021:2705 |
| Red Hat OpenShift Serverless 1.17 | Fixed | RHSA-2021:3556 |
Not affected: 4 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27918
- 2026-10-03 Alias added: GHSA-8mmp-c685-53vw
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-27918 · CVE Program
- CVE-2021-27918 · NVD
- FIRST EPSS
- GHSA-8mmp-c685-53vw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-27918 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences