Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a…
Priority LOW 32CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 18 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Why it matters now
EPSS 0.03114 87th percentileScored 2026-11-07
Fix Partial Red Hat: 15 advisoriesRed Hat: 10 fixed, 18 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.15.15; 1.16.0 to before 1.16.7 | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* | before 21.1.1.1.0 | Vulnerable | Oracle |
| cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:* | before 2.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.15.15; 1.16.0 to before 1.16.7 Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 21.1.1.1.0 Vulnerable ·Oracle
- cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:* Versions before 2.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
Red Hat 15 advisories
- RHSA-2022:7457 Released 2022-11-08 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.s390x::container-tools:rhel8 +47
- RHSA-2022:4668 Released 2022-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.10.1 Images security and bug fix update
- CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
- RHSA-2022:1396 Released 2022-04-19 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.5.4 security update
- 8Base-RHMTC-1.5 rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 +3
Show 12 more Red Hat advisories
- RHSA-2022:1372 Released 2022-04-13 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.10.0 enhancement, security & bug fix update
- RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +21
- RHSA-2022:1361 Released 2022-04-13 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.10.0 RPM security,enhancement&bugfix update
- RHODF 4.10 for RHEL 8 mcg-5.10.0-72.el8, mcg-redistributable-5.10.0-72.el8
- RHSA-2022:1276 Released 2022-04-07 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.0.9 security update
- OpenShift Service Mesh 2.0 kiali-v1.24.7.redhat1-1.el8, servicemesh-2.0.9-3.el8, servicemesh-istioctl-2.0.9-3.el8 +6
- RHSA-2022:0577 Released 2022-03-28 · Red Hat rating ModerateWindows Container Support for Red Hat OpenShift 5.0.0 [security update]
- Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
- RHSA-2022:0947 Released 2022-03-16 · Red Hat rating ModerateOpenShift Virtualization 4.10.0 Images security and bug fix update
- CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
- RHSA-2022:0855 Released 2022-03-14 · Red Hat rating ModerateOpenShift sandboxed containers 1.2.0 security update
- OpenShift Sandboxed Containers 1.2.0 openshift-sandboxed-containers/osc-rhel8-operator
- RHSA-2022:0561 Released 2022-02-23 · Red Hat rating ModerateOpenShift Container Platform 4.9.22 security update
- Red Hat OpenShift Container Platform 4.9 openshift4/egress-router-cni-alt-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:0557 Released 2022-02-23 · Red Hat rating ModerateOpenShift Container Platform 4.9.22 security update
- Red Hat OpenShift Container Platform 4.9 butane-0.13.1-2.rhaos4.9.el8, butane-redistributable-0.13.1-2.rhaos4.9.el8, cri-o-1.22.1-17.rhaos4.9.git3029b1d.2.el8 +14
- RHSA-2022:0318 Released 2022-01-27 · Red Hat rating ModerateRed Hat OpenShift distributed tracing 2.1.0 security update
- Red Hat OpenShift distributed tracing 2.1 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +9
- RHSA-2021:4766 Released 2021-11-23 · Red Hat rating ModerateRelease of OpenShift Serverless 1.19.0
- Red Hat OpenShift Serverless 1.19 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +27
- RHSA-2021:4765 Released 2021-11-23 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.19.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-0.25.1-1.el8
- RHSA-2021:4156 Released 2021-11-09 · Red Hat rating Moderatego-toolset:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.src::go-toolset:rhel8, delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64::go-toolset:rhel8, go-toolset-1.16.7-1.module+el8.5.0+12246+1aac4e3f.aarch64::go-toolset:rhel8 +18
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.2 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.5 | Fixed | RHSA-2022:1396 |
| CNV 4.9 for RHEL 8 | Fixed | — |
| OpenShift Sandboxed Containers 1.2.0 | Fixed | RHSA-2022:0855 |
| OpenShift Service Mesh 2.0 | Fixed | RHSA-2022:1276 |
| RHODF 4.10 for RHEL 8 | Fixed | RHSA-2022:1361, RHSA-2022:1372 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4156, RHSA-2022:7457 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0577 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2022:0557, RHSA-2022:0561 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2021:4765 |
| Red Hat OpenShift Serverless 1.19 | Fixed | RHSA-2021:4766 |
Not affected: 16 products
- 7Server-RHMTC-1.5
- 8Base-RHMTC-1.5
- CNV 4.9 for RHEL 8
- OpenShift Sandboxed Containers 1.2.0
- OpenShift Service Mesh 2.0
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat OpenShift Virtualization 2
- Red Hat OpenShift Virtualization 4
- Red Hat OpenShift distributed tracing 2
- Red Hat Openshift Container Storage 4
- Red Hat Quay 3
- Red Hat Storage 3
- Service Telemetry Framework 1.3 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36221
- 2026-10-03 Alias added: GHSA-6qcx-qr4g-4fx9
References
Advisory 9
- https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0
- FEDORA-2021-38b51d9fd3
- FEDORA-2021-6a3024b3fd
- FEDORA-2021-e71b05ba7b
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://groups.google.com/g/golang-announce/c/uHACNfXAZqk
- [debian-lts-announce] 20220121 [SECURITY] [DLA 2891-1] golang-1.8 security update
- [debian-lts-announce] 20220121 [SECURITY] [DLA 2892-1] golang-1.7 security update
- GLSA-202208-02
Sources
- CVE-2021-36221 · CVE Program
- CVE-2021-36221 · NVD
- FIRST EPSS
- GHSA-6qcx-qr4g-4fx9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-36221 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences