Read the docs
TI-2021-18416 Aliases CVE-2021-41772GHSA-8rv2-6fw3-rxjg

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a…

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

Why it matters now

EPSS 0.03253 88th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 6 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.16.10; 1.17.0 to before 1.17.3VulnerableGo standard library
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:a:oracle:timesten_in-memory_database:-:*:*:*:*:*:*:*not specified by NVDVulnerableOracle
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.16.10; 1.17.0 to before 1.17.3 Vulnerable ·Go standard library
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:timesten_in-memory_database:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Oracle

Remediation

Red Hat 7 advisories

  • RHSA-2022:1819 Released 2022-05-10 · Red Hat rating Moderate
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.7-1.module+el8.6.0+14297+32a15e19.aarch64::go-toolset:rhel8 +18
  • RHSA-2022:1747 Released 2022-05-09 · Red Hat rating Low
    Release of OpenShift Serverless Version 1.22.0
    • Red Hat OpenShift Serverless 1.22 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
  • RHSA-2022:1745 Released 2022-05-09 · Red Hat rating Low
    Release of OpenShift Serverless Client kn 1.22.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.1.0-2.el8
Show 4 more Red Hat advisories
  • RHSA-2022:1734 Released 2022-05-05 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.1 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-velero-rhel8
  • RHSA-2022:0056 Released 2022-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.3 security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2022:0055 Released 2022-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.10 coreos-installer-0.12.0-1.rhaos4.10.el8, coreos-installer-bootinfra-0.12.0-1.rhaos4.10.el8, cri-o-1.23.0-92.rhaos4.10.gitdaab4d1.el7 +11
  • RHSA-2021:5176 Released 2021-12-16 · Red Hat rating Important
    go-toolset-1.16 and go-toolset-1.16-golang security and bug fix update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.16-1.16.12-1.el7_9, go-toolset-1.16-build-1.16.12-1.el7_9, go-toolset-1.16-golang-1.16.12-1.el7_9 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Service Telemetry Framework 1.2 for RHEL 8AffectedNo fix planned: Will not fix
8Base-RHMTC-1.7Fixed RHSA-2022:1734
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:5176
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:1819
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0055, RHSA-2022:0056
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:1745
Red Hat OpenShift Serverless 1.22Fixed RHSA-2022:1747
Not affected: 14 products
  • 8Base-RHMTC-1.7
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Virtualization 2
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3
  • Red Hat Storage 3
  • Service Telemetry Framework 1.2 for RHEL 8
  • Service Telemetry Framework 1.3 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41772
  2. 2026-10-03 Alias added: GHSA-8rv2-6fw3-rxjg

References

Advisory 6

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences