Read the docs
TI-2021-11653 Aliases CVE-2021-31525GHSA-h86h-8ppg-mxmh

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a…

Priority LOW 33CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 19 fixed, 12 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Why it matters now

EPSS 0.03692 89th percentileScored 2026-11-07
Fix Partial golang.org/x/net (Go): 0.0.0-20210428140749-89ef3d95e781Red Hat: 19 advisoriesRed Hat: 19 fixed, 12 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—golang.org/x/net (Go)before 0.0.0-20210428140749-89ef3d95e7810.0.0-20210428140749-89ef3d95e781Patch availableGHSA-h86h-8ppg-mxmh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • golang.org/x/net (Go) Vendor— Affected before 0.0.0-20210428140749-89ef3d95e781 Fixed in 0.0.0-20210428140749-89ef3d95e781 Patch available GHSA-h86h-8ppg-mxmh

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.15.12; 1.16.0 to before 1.16.4VulnerableGo standard library
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.15.12; 1.16.0 to before 1.16.4 Vulnerable ·Go standard library
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-h86h-8ppg-mxmh golang.org/x/net (Go) Fixed in 0.0.0-20210428140749-89ef3d95e781 Advisory →

Red Hat 19 advisories

  • RHSA-2022:0577 Released 2022-03-28 · Red Hat rating Moderate
    Windows Container Support for Red Hat OpenShift 5.0.0 [security update]
    • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
  • RHSA-2022:0308 Released 2022-01-27 · Red Hat rating Moderate
    OpenShift Container Storage 3.11.z security and bug fix update
    • Red Hat Gluster Storage Server 3.5 on RHEL-7 heketi-10.4.0-2.el7rhgs, heketi-client-10.4.0-2.el7rhgs, python-heketi-10.4.0-2.el7rhgs
    • Red Hat Storage Native Client for Red Hat Enterprise Linux 7 heketi-10.4.0-2.el7rhgs, heketi-client-10.4.0-2.el7rhgs
  • RHSA-2022:0191 Released 2022-01-19 · Red Hat rating Moderate
    OpenShift Virtualization 4.9.2 Images security and bug fix update
    • CNV 4.9 for RHEL 8 container-native-virtualization/virt-cdi-importer
Show 16 more Red Hat advisories
  • RHSA-2021:5072 Released 2021-12-09 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1 (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-3.1.el8ost.1
  • RHSA-2021:4103 Released 2021-11-02 · Red Hat rating Moderate
    OpenShift Virtualization 4.9.0 RPMs security and bug fix update
    • CNV 4.9 for RHEL 7 kubevirt-4.9.0-287.el7, kubevirt-virtctl-4.9.0-287.el7, kubevirt-virtctl-redistributable-4.9.0-287.el7
    • CNV 4.9 for RHEL 8 kubevirt-4.9.0-287.el8, kubevirt-virtctl-4.9.0-287.el8, kubevirt-virtctl-redistributable-4.9.0-287.el8
  • RHSA-2021:4104 Released 2021-11-02 · Red Hat rating Moderate
    OpenShift Virtualization 4.9.0 Images security and bug fix update
    • CNV 4.9 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +24
  • RHSA-2021:3759 Released 2021-10-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.9 openshift4/ose-baremetal-rhel8-operator, openshift4/ose-console, openshift4/ose-etcd +4
  • RHSA-2021:3748 Released 2021-10-07 · Red Hat rating Moderate
    OpenShift Container Storage 3.11.z Container Images Security and Bug Fix Update
    • Red Hat Gluster Storage Server 3.5 on RHEL-7 rhgs3/rhgs-gluster-block-prov-rhel7
  • RHSA-2021:3733 Released 2021-10-06 · Red Hat rating Low
    OpenShift Virtualization 2.6.7 Images security and bug fix update
    • CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
  • RHSA-2021:3556 Released 2021-09-16 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.17.0
    • Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
  • RHSA-2021:3555 Released 2021-09-16 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.17.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.23.2-1.el8
  • RHSA-2021:3487 Released 2021-09-15 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-3.1.el8ost.1
  • RHSA-2021:3248 Released 2021-08-31 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.9 packages and security update
    • Red Hat OpenShift Container Platform 4.8 containernetworking-plugins-0.8.6-3.rhaos4.6.el7, cri-tools-1.21.0-3.el8, golang-github-prometheus-promu-0.5.0-4.git642a960.el8 +1
  • RHSA-2021:3076 Released 2021-08-10 · Red Hat rating Moderate
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-1.module+el8.4.0+11833+614b07b8.aarch64::go-toolset:rhel8 +18
  • RHSA-2021:2983 Released 2021-08-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
  • RHSA-2021:2984 Released 2021-08-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 cri-o-1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o-1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-2.9.0-7.rhaos4.8.el8 +9
  • RHSA-2021:2705 Released 2021-07-13 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.16.0
    • Red Hat OpenShift Serverless 1.16 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
  • RHSA-2021:2704 Released 2021-07-13 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.16.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.22.0-3.el8
  • RHSA-2021:2543 Released 2021-06-24 · Red Hat rating Moderate
    Red Hat OpenShift Jaeger 1.20.4 security update
    • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for ContainersAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform Assisted Installer 1AffectedNo fix yet
Red Hat OpenShift Virtualization 2AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
7Server-RHMTC-1.4Fixed—
8Base-RHMTC-1.4Fixed—
CNV 2.6 for RHEL 8Fixed RHSA-2021:3733
CNV 4.9 for RHEL 7Fixed RHSA-2021:4103
CNV 4.9 for RHEL 8Fixed RHSA-2021:4103, RHSA-2021:4104, RHSA-2022:0191
RHACS 3.62 for RHEL 8Fixed—
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3076
Red Hat Gluster Storage Server 3.5 on RHEL-7Fixed RHSA-2021:3748, RHSA-2022:0308
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0577
Red Hat OpenShift Container Platform 4.7Fixed—
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2983, RHSA-2021:2984, RHSA-2021:3248
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2021:3759
Red Hat OpenShift Jaeger 1.20Fixed RHSA-2021:2543
Red Hat OpenShift Serverless 1.0Fixed RHSA-2021:2704, RHSA-2021:3555
Red Hat OpenShift Serverless 1.16Fixed RHSA-2021:2705
Red Hat OpenShift Serverless 1.17Fixed RHSA-2021:3556
Red Hat OpenStack Platform 16.1Fixed RHSA-2021:5072
Red Hat OpenStack Platform 16.2Fixed RHSA-2021:3487
Red Hat Storage Native Client for Red Hat Enterprise Linux 7Fixed RHSA-2022:0308
Not affected: 10 products
  • CNV 4.9 for RHEL 8
  • RHACS 3.62 for RHEL 8
  • Red Hat Ceph Storage 4
  • Red Hat Enterprise Linux 9
  • Red Hat Gluster Storage Server 3.5 on RHEL-7
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat OpenShift Virtualization 2
  • Red Hat Openshift Container Storage 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31525
  2. 2026-10-03 Alias added: GHSA-h86h-8ppg-mxmh

References

Patch 1

Advisory 4

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences