CVE-2021-38561 golang.org/x/text/language Out-of-bounds Read vulnerability

High 7.5 Published 26 Dec 2022 Updated 14 Apr 2025

An attacker can cause a denial of service by triggering a panic via malformed BCP 47 language tags in the Go text library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-38561?

CVE-2021-38561 is a high-severity denial of service vulnerability in n/a, published on 26 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Weakness: CWE-125

Which versions are affected by CVE-2021-38561?

3 open source packages ship an affected version, including golang.org/x/text. It affects 1 product.

Package	Affected	Fixed in
`golang.org/x/text` Go	All versions	`0.3.7`
`golang.org/x/text` Go	All versions	`0.3.7`
`golang.org/x/text` Go	All versions	`0.3.7`

Linux distribution packages (1)

cni openSUSE:Tumbleweed All versions 1.1.2-2.1

Products include Golang Text.

How do I fix CVE-2021-38561?

Upgrade golang.org/x/text to 0.3.7 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-38561 being exploited?

There is no known exploitation of CVE-2021-38561 in the wild and no public exploit code.

Sources

Also known as AZL-41221, AZL-41469, AZL-44622, AZL-44952, AZL-45375, CLEANSTART-2025-PK28736 and 6 more.