Skip to content
Fencer Vulns
high 7.5

CVE-2021-27918 json

Infinite loop when decoding inputs in encoding/xml

published 2021-03-10 5 y ago modified 2026-09-08 2 mo ago also BIT-golang-2021-27918 , EUVD-2021-14641 , GO-2021-0234

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

Patch / fix

  • bitnami golang 1.15.9, 1.16.1
  • go stdlib 1.15.9, 1.16.1
  • golang go 1.15.9, 1.16.1
  • golang-1.15 Debian 11 1.15.9-1

debian advisories DEBIAN-CVE-2021-27918

  • delve RHEL 8 1.5.0-2.module+el8.4.0+8864+58b0fcdb
  • golang RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • go-toolset RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-bin RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-src RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-misc RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-race RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8
  • golang-tests RHEL 8 1.15.14-1.module+el8.4.0+11833+614b07b8

red hat advisories RHSA-2021:3076RHSA-2021:3555RHSA-2021:2704

  • go1.15 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +7 more 1.15.10-1.25.1
  • go1.16 SLE Module for Development Tools 15 SP2 1.16.2-1.8.1

suse advisories SUSE-SU-2021:0938-1SUSE-SU-2021:0937-1

  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.16 openSUSE Tumbleweed 1.16.8-1.1
  • go1.15 openSUSE Leap 15.2 1.15.10-lp152.14.1

opensuse advisories openSUSE-SU-2024:10808-1openSUSE-SU-2024:10809-1openSUSE-SU-2021:0480-1

  • delve Rocky Linux 8 1.5.0-2.module+el8.4.0+396+d2d16ae3
  • golang Rocky Linux 8 1.15.14-1.module+el8.4.0+632+4dba2916
  • go-toolset Rocky Linux 8 1.15.14-1.module+el8.4.0+632+4dba2916

rocky linux advisories RLSA-2021:3076

  • go Alpine 3.13 1.15.10-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.2-r0

alpine advisories ALPINE-CVE-2021-27918

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.16.1-1

arch linux advisories AVG-1668

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-27918 updated cvss 7.5

golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-rhel8-operator, distributed-tracing/jaeger-collector-rhel8, distributed-tracing/jaeger-all-in-one-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/kn-serving-controller-rhel9, openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-operator, +4 more
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, libgcc, libitm, +20 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 cri-o, atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, +8 more Red Hat OpenShift Container Platform 4 cri-o, cri-tools, openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, +4 more
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 mcg, odf4/ocs-rhel9-operator
    affected: no fix available
  • Red Hat OpenShift Virtualization 2 virt-handler-container, virt-launcher-container, kubevirt-vmware-container, virt-cdi-apiserver-container, kubevirt-cpu-model-nfd-plugin, hostpath-provisioner-container, +5 more
    affected: no fix planned “Will not fix”
  • Red Hat Storage 3 golang, heketi, grafana, golang-bin, golang-src, golang-misc, +3 more
    affected: no fix available, no fix planned “Will not fix”
show 6 more
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.5.0-2.module+el8.4.0+8864+58b0fcdb, golang 1.15.14-1.module+el8.4.0+11833+614b07b8, go-toolset 1.15.14-1.module+el8.4.0+11833+614b07b8, golang-bin 1.15.14-1.module+el8.4.0+11833+614b07b8, golang-src 1.15.14-1.module+el8.4.0+11833+614b07b8, golang-misc 1.15.14-1.module+el8.4.0+11833+614b07b8, +2 more
    fixed: vendor fix RHSA-2021:3076
  • Red Hat OpenShift Container Storage 4.8 on RHEL-8 ocs4/ocs-operator-bundle 4.8.0-5, ocs4/mcg-core-rhel8 5.8.0-38.e060925.5.8, ocs4/mcg-rhel8-operator 5.8.0-27.4a6ca5f.5.8, ocs4/cephcsi-rhel8 4.8-125.01872cc.release_4.8, ocs4/ocs-rhel8-operator 4.8-196.a35d7d7.release_4.8, ocs4/ocs-must-gather-rhel8 4.8-196.a35d7d7.release_4.8, +2 more
    fixed: vendor fix RHBA-2021:3003
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.22.0-3.el8, openshift-serverless-clients 0.23.2-1.el8
    fixed: vendor fix RHSA-2021:2704
  • Red Hat OpenShift Serverless 1.16 openshift-serverless-1/client-kn-rhel8 0.22.0-4, openshift-serverless-1/serving-queue-rhel8 0.22.0-4, openshift-serverless-1/eventing-mtping-rhel8 0.22.0-2, openshift-serverless-1/kourier-control-rhel8 0.22.0-2, openshift-serverless-1/serving-webhook-rhel8 0.22.0-3, openshift-serverless-1/eventing-webhook-rhel8 0.22.0-2, +24 more
    fixed: vendor fix RHSA-2021:2705
  • Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8 0.23.2-2, openshift-serverless-1/serving-queue-rhel8 0.23.1-2, openshift-serverless-1/eventing-mtping-rhel8 0.23.0-5, openshift-serverless-1/kourier-control-rhel8 0.23.0-4, openshift-serverless-1/serving-webhook-rhel8 0.23.1-2, openshift-serverless-1/eventing-webhook-rhel8 0.23.0-5, +24 more
    fixed: vendor fix RHSA-2021:3556
  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests Red Hat Enterprise Linux 8 cpp, gcc, libgcc, libitm, buildah, gcc-c++, +24 more Red Hat Enterprise Linux 9 cpp, gcc, golang, libgcc, libitm, buildah, +22 more Red Hat Storage 3 etcd, rhgs3/rhgs-gluster-block-prov-rhel7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.47% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.15.9
>=1.16.0, <1.16.1
1.15.9
1.16.1
go stdlib
<1.15.9
>=1.16.0-0, <1.16.1
1.15.9
1.16.1

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.