Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not…
Priority LOW 38CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 22 fixed, 18 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
Why it matters now
EPSS 0.03204 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 26 advisoriesRed Hat: 22 fixed, 18 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.15.13; 1.16.0 to before 1.16.5 | Vulnerable | Go standard library |
| cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.15.13; 1.16.0 to before 1.16.5 Vulnerable ·Go standard library
- cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 26 advisories
- RHSA-2022:8008 Released 2022-11-15 · Red Hat rating Moderatebuildah security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.27.0-2.el9, buildah-tests-1:1.27.0-2.el9
- RHSA-2022:1402 Released 2022-04-19 · Red Hat rating ModerateOpenShift Virtualization 2.6.10 RPMs security and bug fix update
- CNV 2.6 for RHEL 7 kubevirt-2.6.10-230.el7, kubevirt-virtctl-2.6.10-230.el7, kubevirt-virtctl-redistributable-2.6.10-230.el7
- CNV 2.6 for RHEL 8 kubevirt-2.6.10-230.el8, kubevirt-virtctl-2.6.10-230.el8, kubevirt-virtctl-redistributable-2.6.10-230.el8
- RHSA-2022:1329 Released 2022-04-12 · Red Hat rating ModerateOpenShift Virtualization 4.8.5 RPMs security update
- CNV 4.8 for RHEL 7 kubevirt-4.8.5-278.el7, kubevirt-virtctl-4.8.5-278.el7, kubevirt-virtctl-redistributable-4.8.5-278.el7
- CNV 4.8 for RHEL 8 kubevirt-4.8.5-278.el8, kubevirt-virtctl-4.8.5-278.el8, kubevirt-virtctl-redistributable-4.8.5-278.el8
Show 23 more Red Hat advisories
- RHSA-2022:0577 Released 2022-03-28 · Red Hat rating ModerateWindows Container Support for Red Hat OpenShift 5.0.0 [security update]
- Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2022:0947 Released 2022-03-16 · Red Hat rating ModerateOpenShift Virtualization 4.10.0 Images security and bug fix update
- CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
- RHSA-2022:0191 Released 2022-01-19 · Red Hat rating ModerateOpenShift Virtualization 4.9.2 Images security and bug fix update
- CNV 4.9 for RHEL 8 container-native-virtualization/virt-cdi-importer
- RHSA-2021:5086 Released 2021-12-13 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
- Red Hat OpenShift Data Foundation 4.9 on RHEL-8 odf/odf-multicluster-rhel8-operator, odf4/cephcsi-rhel8, odf4/ocs-must-gather-rhel8 +12
- RHSA-2021:5085 Released 2021-12-13 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
- Red Hat OpenShift Data Foundation 4.9 on RHEL-8 mcg-5.9.0-28.61dcf87.5.9.el8
- RHSA-2021:5072 Released 2021-12-09 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-3.1.el8ost.1
- RHSA-2021:4226 Released 2021-11-09 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.9-4.el8
- RHSA-2021:4156 Released 2021-11-09 · Red Hat rating Moderatego-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.src::go-toolset:rhel8, delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64::go-toolset:rhel8, go-toolset-1.16.7-1.module+el8.5.0+12246+1aac4e3f.aarch64::go-toolset:rhel8 +18
- RHSA-2021:4104 Released 2021-11-02 · Red Hat rating ModerateOpenShift Virtualization 4.9.0 Images security and bug fix update
- CNV 4.9 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +24
- RHSA-2021:3820 Released 2021-10-19 · Red Hat rating ModerateOpenShift Container Platform 4.8.15 packages and security update
- Red Hat OpenShift Container Platform 4.8 butane-0.12.1-2.rhaos4.8.el8, jenkins-2.289.3.1633554819-1.el8
- RHSA-2021:3759 Released 2021-10-18 · Red Hat rating ModerateOpenShift Container Platform 4.9.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.9 openshift4/ose-baremetal-rhel8-operator, openshift4/ose-console, openshift4/ose-etcd +4
- RHSA-2021:3598 Released 2021-09-21 · Red Hat rating ModerateOpenShift Virtualization 4.8.2 Images security and bug fix update
- CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
- RHSA-2021:3556 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless 1.17.0
- Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:3555 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.17.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.23.2-1.el8
- RHSA-2021:3487 Released 2021-09-15 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-3.1.el8ost.1
- RHSA-2021:3431 Released 2021-09-07 · Red Hat rating Moderatego-toolset-1.15-golang security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15-golang-1.15.14-2.el7_9, go-toolset-1.15-golang-bin-1.15.14-2.el7_9, go-toolset-1.15-golang-docs-1.15.14-2.el7_9 +4
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15-golang-1.15.14-2.el7_9, go-toolset-1.15-golang-bin-1.15.14-2.el7_9, go-toolset-1.15-golang-docs-1.15.14-2.el7_9 +4
- RHSA-2021:3248 Released 2021-08-31 · Red Hat rating ModerateOpenShift Container Platform 4.8.9 packages and security update
- Red Hat OpenShift Container Platform 4.8 containernetworking-plugins-0.8.6-3.rhaos4.6.el7, cri-tools-1.21.0-3.el8, golang-github-prometheus-promu-0.5.0-4.git642a960.el8 +1
- RHSA-2021:3361 Released 2021-08-31 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.5.1 security and bug fix update
- 8Base-RHMTC-1.5 rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 +2
- RHSA-2021:3229 Released 2021-08-19 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.20.5 security update
- Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +3
- RHSA-2021:3146 Released 2021-08-12 · Red Hat rating ModerateACS 3.64 security and enhancement update
- RHACS 3.64 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator
- RHSA-2021:3009 Released 2021-08-12 · Red Hat rating ModerateOpenShift Container Platform 4.6.42 security update
- Red Hat OpenShift Container Platform 4.6 ignition-2.6.0-8.rhaos4.6.git947598e.el8, ignition-validate-2.6.0-8.rhaos4.6.git947598e.el8
- RHSA-2021:2983 Released 2021-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.8.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2021:2984 Released 2021-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.8.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 cri-o-1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o-1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-2.9.0-7.rhaos4.8.el8 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.2 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.5 | Fixed | RHSA-2021:3361 |
| CNV 2.6 for RHEL 7 | Fixed | RHSA-2022:1402 |
| CNV 2.6 for RHEL 8 | Fixed | RHSA-2022:1402 |
| CNV 4.8 for RHEL 7 | Fixed | RHSA-2022:1329 |
| CNV 4.8 for RHEL 8 | Fixed | RHSA-2021:3598, RHSA-2022:1329 |
| CNV 4.9 for RHEL 8 | Fixed | RHSA-2021:4104, RHSA-2022:0191 |
| RHACS 3.64 for RHEL 8 | Fixed | RHSA-2021:3146 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3431 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3431 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4156, RHSA-2021:4226 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:8008 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0577 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:3009 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | — |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2983, RHSA-2021:2984, RHSA-2021:3248, RHSA-2021:3820 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2021:3759 |
| Red Hat OpenShift Data Foundation 4.9 on RHEL-8 | Fixed | RHSA-2021:5085, RHSA-2021:5086 |
| Red Hat OpenShift Jaeger 1.20 | Fixed | RHSA-2021:3229 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:3555 |
| Red Hat OpenShift Serverless 1.17 | Fixed | RHSA-2021:3556 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2021:5072 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2021:3487 |
Not affected: 18 products
- 7Server-RHMTC-1.5
- 8Base-RHMTC-1.5
- CNV 4.9 for RHEL 8
- RHACS 3.64 for RHEL 8
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift Jaeger 1.20
- Red Hat OpenShift Virtualization 2
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Quay 3
- Service Telemetry Framework 1.3 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33195
- 2026-10-03 Alias added: GHSA-xf7m-5vgf-jhv9
References
Sources
- CVE-2021-33195 · CVE Program
- CVE-2021-33195 · NVD
- FIRST EPSS
- GHSA-xf7m-5vgf-jhv9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-33195 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences