In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an…
Priority LOW 39CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
Why it matters now
EPSS 0.03464 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 11 advisoriesRed Hat: 10 fixed, 11 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.15.13; 1.16.0 to before 1.16.5 | Vulnerable | Go standard library |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.15.13; 1.16.0 to before 1.16.5 Vulnerable ·Go standard library
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
Red Hat 11 advisories
- RHSA-2021:3758 Released 2021-10-18 · Red Hat rating ModerateOpenShift Container Platform 4.9.0 packages and security update
- Red Hat OpenShift Container Platform 4.9 coreos-installer-0.10.0-2.rhaos4.9.el8, coreos-installer-bootinfra-0.10.0-2.rhaos4.9.el8, jenkins-2.289.3.1630554997-1.el8 +10
- RHSA-2021:3556 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless 1.17.0
- Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:3555 Released 2021-09-16 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.17.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.23.2-1.el8
Show 8 more Red Hat advisories
- RHSA-2021:3361 Released 2021-08-31 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.5.1 security and bug fix update
- 8Base-RHMTC-1.5 rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 +2
- RHSA-2021:3229 Released 2021-08-19 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.20.5 security update
- Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +3
- RHSA-2021:3076 Released 2021-08-10 · Red Hat rating Moderatego-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-1.module+el8.4.0+11833+614b07b8.aarch64::go-toolset:rhel8 +18
- RHSA-2021:2983 Released 2021-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.8.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2021:2984 Released 2021-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.8.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 cri-o-1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o-1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-2.9.0-7.rhaos4.8.el8 +9
- RHSA-2021:2705 Released 2021-07-13 · Red Hat rating ModerateRelease of OpenShift Serverless 1.16.0
- Red Hat OpenShift Serverless 1.16 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:2704 Released 2021-07-13 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.16.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.22.0-3.el8
- RHSA-2021:2634 Released 2021-07-01 · Red Hat rating Moderatego-toolset-1.15 and go-toolset-1.15-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.15-1.15.13-1.el7_9, go-toolset-1.15-build-1.15.13-1.el7_9, go-toolset-1.15-golang-1.15.13-1.el7_9 +8
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.15-1.15.13-1.el7_9, go-toolset-1.15-build-1.15.13-1.el7_9, go-toolset-1.15-golang-1.15.13-1.el7_9 +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.2 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.5 | Fixed | RHSA-2021:3361 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:2634 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:2634 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3076 |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2983, RHSA-2021:2984 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2021:3758 |
| Red Hat OpenShift Jaeger 1.20 | Fixed | RHSA-2021:3229 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:2704, RHSA-2021:3555 |
| Red Hat OpenShift Serverless 1.16 | Fixed | RHSA-2021:2705 |
| Red Hat OpenShift Serverless 1.17 | Fixed | RHSA-2021:3556 |
Not affected: 12 products
- 7Server-RHMTC-1.5
- 8Base-RHMTC-1.5
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift Jaeger 1.20
- Red Hat OpenShift Virtualization 2
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33196
- 2026-10-03 Alias added: GHSA-6r28-26q2-vxwj
References
Advisory 4
Sources
- CVE-2021-33196 · CVE Program
- CVE-2021-33196 · NVD
- FIRST EPSS
- GHSA-6r28-26q2-vxwj · GitHub Advisory Database · CC BY 4.0
- CVE-2021-33196 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences