golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an…
Priority MEDIUM 42CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 15 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01484 74th percentileScored 2026-11-07
Fix Partial golang.org/x/text (Go): 0.3.7Red Hat: 30 advisoriesRed Hat: 13 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | golang.org/x/text (Go) | before 0.3.7 | 0.3.7 | Patch available | GHSA-ppp9-7jff-5vj2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- golang.org/x/text (Go) Vendor— Affected before 0.3.7 Fixed in 0.3.7 Patch available GHSA-ppp9-7jff-5vj2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:text:*:*:*:*:*:*:*:* | before 0.3.7 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:text:*:*:*:*:*:*:*:* Versions before 0.3.7 Vulnerable ·Go standard library
Remediation
- Fix · GHSA-ppp9-7jff-5vj2 golang.org/x/text (Go) Fixed in 0.3.7 Advisory →
Red Hat 30 advisories
- RHSA-2023:4982 Released 2023-09-05 · Red Hat rating ModerateOpenShift Virtualization 4.12.6 Images
- CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +40
- RHSA-2023:4310 Released 2023-08-02 · Red Hat rating ModerateOpenShift Container Platform 4.11.46 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-aws-ebs-csi-driver-rhel8
- RHSA-2023:3542 Released 2023-06-14 · Red Hat rating ModerateOpenShift Container Platform 4.11.43 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-multus-cni
Show 27 more Red Hat advisories
- RHSA-2023:1328 Released 2023-05-18 · Red Hat rating ModerateOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/dpu-network-rhel8-operator, openshift4/metallb-rhel8-operator, openshift4/ose-aws-efs-csi-driver-container-rhel8 +17
- RHSA-2023:1326 Released 2023-05-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:1504 Released 2023-04-04 · Red Hat rating ModerateOpenShift Container Platform 4.11.34 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8 +47
- RHSA-2023:1409 Released 2023-03-27 · Red Hat rating ModerateOpenShift Container Platform 4.12.9 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-csi-driver-manila-rhel8-operator, openshift4/ose-multus-cni
- RHSA-2023:0890 Released 2023-02-28 · Red Hat rating ModerateOpenShift Container Platform 4.12.5 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-network-metrics-daemon-rhel8
- RHSA-2023:0895 Released 2023-02-28 · Red Hat rating ModerateOpenShift Container Platform 4.11.29 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-network-metrics-daemon-rhel8
- RHSA-2023:0774 Released 2023-02-21 · Red Hat rating ImportantOpenShift Container Platform 4.11.28 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer, openshift4/ose-installer-artifacts +1
- RHSA-2023:0652 Released 2023-02-15 · Red Hat rating ModerateOpenShift Container Platform 4.11.27 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-ansible-operator, openshift4/ose-helm-operator
- RHSA-2023:0566 Released 2023-02-07 · Red Hat rating ModerateOpenShift Container Platform 4.11.26 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-operator-sdk-rhel8
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2023:0407 Released 2023-01-24 · Red Hat rating ModerateOpenShift Virtualization 4.12.0 RPMs security update
- CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
- CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
- RHSA-2023:0245 Released 2023-01-23 · Red Hat rating ModerateOpenShift Container Platform 4.11.25 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-installer
- RHSA-2022:7399 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:7401 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-aws-efs-csi-driver-container-rhel8, openshift4/ose-node-feature-discovery
- RHSA-2022:8750 Released 2022-12-01 · Red Hat rating ModerateOpenShift Virtualization 4.11.1 security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6537 Released 2022-09-20 · Red Hat rating ModerateModerate:OpenShift Container Platform 4.11.5 security and extras update
- Red Hat OpenShift Container Platform 4.11 openshift4/kubernetes-nmstate-rhel8-operator, openshift4/ose-kubernetes-nmstate-handler-rhel8, openshift4/ose-sriov-network-config-daemon +1
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6318 Released 2022-09-12 · Red Hat rating ModerateOpenShift Container Platform 4.9.48 extras security update
- Red Hat OpenShift Container Platform 4.9 openshift4/ose-ptp-operator, openshift4/ptp-must-gather-rhel8
- RHSA-2022:6263 Released 2022-09-09 · Red Hat rating ModerateOpenShift Container Platform 4.6.61 security and extras update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-elasticsearch-operator, openshift4/ose-elasticsearch-proxy
- RHSA-2022:6287 Released 2022-09-07 · Red Hat rating ModerateOpenShift Container Platform 4.11.3 packages and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-sriov-network-operator
- RHSA-2022:6346 Released 2022-09-06 · Red Hat rating ModerateRHSA: Submariner 0.13 - security and enhancement update
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
- RHSA-2022:6051 Released 2022-08-18 · Red Hat rating ImportantLogging Subsystem 5.5.0 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +6
- RHSA-2022:5070 Released 2022-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.11.0 extras and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-event-proxy-rhel8, openshift4/kubernetes-nmstate-rhel8-operator, openshift4/ose-cloud-event-proxy +1
- RHSA-2022:5909 Released 2022-08-04 · Red Hat rating ModerateOpenshift Logging Bug Fix and security update Release (5.2.13)
- OpenShift Logging 5.2 openshift-logging/elasticsearch-rhel8-operator
- RHSA-2022:5908 Released 2022-08-04 · Red Hat rating ModerateOpenshift Logging Bug Fix and security update Release (5.3.10)
- OpenShift Logging 5.3 openshift-logging/elasticsearch-rhel8-operator
- RHSA-2022:5556 Released 2022-07-18 · Red Hat rating ModerateLogging Subsystem 5.4.3 - Red Hat OpenShift security update
- RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-rhel8-operator
- RHSA-2022:5525 Released 2022-07-07 · Red Hat rating ModerateService Binding Operator security update
- OpenShift Developer Tools and Services for OCP 4.7 for RHEL 8 ocp-tools-4/service-binding-operator-bundle, ocp-tools-4/service-binding-rhel8-operator
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| CNV 4.11 for RHEL 8 | Fixed | RHSA-2022:6526 |
| CNV 4.12 for RHEL 7 | Fixed | RHSA-2023:0407 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0407, RHSA-2023:0408, RHSA-2023:4982 |
| OpenShift Developer Tools and Services for OCP 4.7 for RHEL 8 | Fixed | RHSA-2022:5525 |
| OpenShift Logging 5.2 | Fixed | RHSA-2022:5909 |
| OpenShift Logging 5.3 | Fixed | RHSA-2022:5908 |
| RHOL 5.4 for RHEL 8 | Fixed | RHSA-2022:5556 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:6051 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5070, RHSA-2022:6287, RHSA-2022:6537, RHSA-2023:0245, RHSA-2023:0566, RHSA-2023:0652, RHSA-2023:0774, RHSA-2023:0895, RHSA-2023:1504, RHSA-2023:3542, RHSA-2023:4310 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7399, RHSA-2022:7401, RHSA-2023:0890, RHSA-2023:1409 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1326, RHSA-2023:1328 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2022:6263 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2022:6318 |
Not affected: 20 products
- CNV 4.11 for RHEL 8
- CNV 4.12 for RHEL 8
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- OpenShift API for Data Protection
- OpenShift Logging 5.2
- OpenShift Logging 5.3
- RHOL 5.4 for RHEL 8
- RHOL 5.5 for RHEL 8
- Red Hat Advanced Cluster Security 3
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenShift Container Platform 4.9
- Red Hat Openshift Data Foundation 4
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38561
- 2026-10-03 Alias added: GHSA-ppp9-7jff-5vj2
References
Patch 2
Advisory 3
More Go standard library Text vulnerabilities
- TI-2022-13882 Denial of service via crafted Accept-Language header in golang.org/x/text/language CVSS 3.1HIGH 7.5
- TI-2020-11000 The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could… CVSS 3.1HIGH 7.5
- TI-2020-17413 In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-38561 · CVE Program
- CVE-2021-38561 · NVD
- FIRST EPSS
- GHSA-ppp9-7jff-5vj2 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-38561 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences