CVE-2021-31525 golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion
Remote attackers can cause a denial of service via large headers in Go's net/http package, affecting servers and clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31525?
CVE-2021-31525 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 27 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Weakness: CWE-674
Which versions are affected by CVE-2021-31525?
5 open source packages ship an affected version, including golang.org/x/net, golang and stdlib. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net Go | All versions | 0.0.0-20210428140749-89ef3d95e781 |
golang.org/x/net Go | All versions | 0.0.0-20210428140749-89ef3d95e781 |
golang.org/x/net Go | All versions | 0.0.0-20210428140749-89ef3d95e781 |
golang Bitnami | All versions | 1.15.12, 1.16.4 |
stdlib Go | All versions | 1.15.12, 1.16.4 |
Linux distribution packages (5)
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.15.12-1.30.1 |
go1.16 SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.16.4-1.14.2 |
go1.15 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.15.12-1.30.1 |
go1.16 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.16.4-1.14.2 |
go1.15 openSUSE:Leap 15.2 | All versions | 1.15.12-lp152.17.1 |
Products include Fedoraproject Fedora, Golang Go.
How do I fix CVE-2021-31525?
Upgrade golang.org/x/net to 0.0.0-20210428140749-89ef3d95e781 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-31525 being exploited?
There is no known exploitation of CVE-2021-31525 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-golang-2021-31525, CLEANSTART-2026-FS34281, CLEANSTART-2026-LX99611, DEBIAN-CVE-2021-31525, GHSA-h86h-8ppg-mxmh, GO-2022-0236 and 4 more.