Skip to content
Fencer Vulns
high 8.6

CVE-2021-3121 json

Improper Input Validation in GoGo Protobuf

published 2021-01-11 5 y ago modified 2026-09-10 1 mo ago also BIT-consul-2021-3121 , BIT-protobuf-2021-3121 , EUVD-2022-1401 , GHSA-c3h9-896r-86jm , GO-2021-0053

cvss
8.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.4%
EPSS 3.4% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Patch / fix

  • go github.com/gogo/protobuf 1.3.2
  • bitnami consul 1.8.15, 1.9.9, 1.10.2
  • bitnami protobuf 1.3.2
  • golang protobuf 1.3.2
  • hashicorp consul 1.8.15, 1.9.9, 1.10.2
  • golang-gogoprotobuf Debian 14, Debian 13, Debian 12 1.3.2-1

debian advisories DEBIAN-CVE-2021-3121

  • golang-gogoprotobuf Ubuntu 22.04 LTS 1.3.2-1

ubuntu advisories UBUNTU-CVE-2021-3121

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kiali service mesh 2.0 v1.24.7.redhat1-1.el8
  • servicemesh service mesh 2.0 2.0.9-3.el8
  • servicemesh-mixc service mesh 2.0 2.0.9-3.el8
  • servicemesh-mixs service mesh 2.0 2.0.9-3.el8
  • servicemesh-proxy service mesh 2.0 2.0.9-3.el8
  • servicemesh-istioctl service mesh 2.0 2.0.9-3.el8
  • servicemesh-prometheus service mesh 2.0 2.14.0-16.el8.1
  • servicemesh-pilot-agent service mesh 2.0 2.0.9-3.el8

red hat advisories RHSA-2022:1276RHSA-2021:2437RHSA-2021:1006RHSA-2020:5634

  • kubernetes1.18 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +6 more 1.18.20-150200.5.25.1

suse advisories SUSE-SU-2025:02977-1

  • kubernetes1.18 openSUSE Tumbleweed 1.18.20-1.2
  • kubernetes1.19 openSUSE Tumbleweed 1.19.15-1.1
  • kubernetes1.20 openSUSE Tumbleweed 1.20.11-1.1
  • kubernetes1.21 openSUSE Tumbleweed 1.21.5-1.1
  • velero openSUSE Tumbleweed 1.7.0-1.1
  • velero-plugin-for-aws openSUSE Tumbleweed 1.3.0-1.1

opensuse advisories openSUSE-SU-2024:10902-1openSUSE-SU-2024:10903-1openSUSE-SU-2024:10904-1openSUSE-SU-2024:10905-1openSUSE-SU-2024:11553-1openSUSE-SU-2024:11554-1

  • protobuf-c Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.3.2-r0

alpine advisories ALPINE-CVE-2021-3121

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3121 updated cvss 8.6

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation

  • Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, +5 more
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +8 more Red Hat OpenShift Container Platform 4 atomic-openshift-service-idler
    affected: no fix planned “Will not fix”
  • Red Hat AMQ Broker 7.10.1
    fixed: vendor fix RHSA-2022:6916
  • Red Hat CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8 v4.8.1-2, container-native-virtualization/vm-import-operator-rhel8 v4.8.0-18
    fixed: vendor fix RHSA-2021:2920
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/kubemacpool v4.9.0-19, container-native-virtualization/bridge-marker v4.9.0-13, container-native-virtualization/ovs-cni-marker v4.9.0-16, container-native-virtualization/cluster-network-addons-operator v4.9.0-27, container-native-virtualization/kubernetes-nmstate-handler-rhel8 v4.9.0-25
    fixed: vendor fix RHSA-2021:4104
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.1.0-2, cryostat-20-tech-preview/cryostat-rhel8 2.1.0-2, cryostat-tech-preview/jfr-datasource-rhel8 2.1.0-1, cryostat-tech-preview/cryostat-reports-rhel8 1.0.0-1, cryostat-20-tech-preview/jfr-datasource-rhel8 2.1.0-1, cryostat-tech-preview/cryostat-rhel8-operator 2.1.0-1, +5 more
    fixed: vendor fix RHSA-2022:1679
  • Red Hat OpenShift Logging 5.0 openshift-logging/eventrouter-rhel8 v5.0.5-6, openshift-logging/elasticsearch-proxy-rhel8 v5.0.5-5, openshift-logging/elasticsearch-rhel8-operator v5.0.5-4, openshift-logging/cluster-logging-rhel8-operator v5.0.4-5
    fixed: vendor fix RHSA-2021:2136
  • Red Hat OpenShift Service Mesh 2.0 kiali v1.24.7.redhat1-1.el8
    fixed: vendor fix RHSA-2022:1276
show 8 more
  • Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8 rhacm2/acm-operator-bundle v2.0.8-7
    fixed: vendor fix RHSA-2021:0719
  • Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8 rhacm2/acm-must-gather-rhel8 v2.1.3-3
    fixed: vendor fix RHSA-2021:0607
  • Red Hat OpenShift Container Platform 4.7 cri-tools 1.18.0-3.el7, cri-tools 1.20.0-1.el8, cri-o 1.20.0-0.rhaos4.7.git8921e00.el7.51, cri-o 1.20.0-0.rhaos4.7.git8921e00.el8.51, openshift4/ose-sdn-rhel8 v4.7.0-202104142050.p0, openshift4/ose-descheduler v4.7.0-202105141603.p0, +149 more
    fixed: vendor fix RHSA-2020:5634
  • Red Hat OpenShift Container Platform 4.8 openshift 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, openshift 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8, openshift-clients 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, openshift-clients 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8, openshift-hyperkube 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, openshift-hyperkube 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8, +40 more
    fixed: vendor fix RHSA-2021:2437
  • Red Hat OpenShift Container Platform 4.9 openshift4/ose-local-storage-diskmaker v4.9.0-202110012022.p0.git.b1dd176.assembly.stream, openshift4/ose-baremetal-rhel8-operator v4.9.0-202109302317.p0.git.cf45440.assembly.stream, openshift4/ose-multus-admission-controller v4.9.0-202109302317.p0.git.3c28a57.assembly.stream, openshift4/ose-network-metrics-daemon-rhel8 v4.9.0-202109302317.p0.git.9fd6103.assembly.stream
    fixed: vendor fix RHSA-2021:3759
  • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator 5.0.0-5, openshift4-wincw/windows-machine-config-operator-bundle v5.0.0-5, openshift4/ose-csi-driver-nfs-rhel8 v4.10.0-202202160023.p0.g3448830.assembly.stream, openshift4/ose-csi-driver-manila-rhel8-operator v4.10.0-202202160023.p0.g16f67d6.assembly.stream
    fixed: vendor fix RHSA-2022:0577
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-telemeter v4.11.0-202209130958.p0.gb1f5dd2.assembly.stream
    fixed: vendor fix RHSA-2022:6536
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-api v4.9.0-61, container-native-virtualization/virtio-win v4.9.0-8, container-native-virtualization/virt-handler v4.9.0-61, container-native-virtualization/virt-launcher v4.9.0-61, container-native-virtualization/virt-operator v4.9.0-61, container-native-virtualization/kubevirt-vmware v4.9.0-8, +27 more Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-query-rhel8, distributed-tracing/jaeger-ingester-rhel8, distributed-tracing/jaeger-rhel8-operator, distributed-tracing/jaeger-collector-rhel8, distributed-tracing/jaeger-all-in-one-rhel8 Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.4-4, openshift-logging/fluentd-rhel8 v5.0.5-5, openshift-logging/kibana6-rhel8 v5.0.4-4, openshift-logging/kibana6-rhel8 v5.0.5-3, openshift-logging/eventrouter-rhel8 v5.0.4-4, openshift-logging/elasticsearch6-rhel8 v5.0.4-4, +10 more Red Hat OpenShift Service Mesh 2.0 servicemesh 2.0.9-3.el8, servicemesh-cni 2.0.9-3.el8, servicemesh-mixc 2.0.9-3.el8, servicemesh-mixs 2.0.9-3.el8, servicemesh-proxy 2.0.9-3.el8, servicemesh-istioctl 2.0.9-3.el8, +4 more Red Hat OpenShift Container Platform 3.11 openshift3/ose-kube-rbac-proxy, openshift3/ose-prometheus-operator, openshift3/ose-cluster-monitoring-operator Red Hat OpenShift Container Platform 4.7 jq 1.6-2.el7, jq 1.6-2.el8, clevis 15-1.el8, faq 0.0.6-5.el8, bootupd 0.2.5-2.el8, ostree 2020.7-1.el8, +1609 more
    +5 more products
    Red Hat OpenShift Container Platform 4.8 podman 3.0.1-6.el8, haproxy 2.2.13-1.el7, haproxy 2.2.13-1.el8, ostree 2020.7-5.el8_4, cri-tools 1.21.0-2.el7, cri-tools 1.21.0-2.el8, +230 more Red Hat OpenShift Container Platform 4.9 openshift4/ose-cli v4.9.0-202109302317.p0.git.96e95ce.assembly.stream, openshift4/ose-pod v4.9.0-202110080828.p0.git.894a78b.assembly.stream, openshift4/ose-ptp v4.9.0-202109302317.p0.git.0a11038.assembly.stream, openshift4/ose-etcd v4.9.0-202109302317.p0.git.5c1feaf.assembly.stream, openshift4/ose-console v4.9.0-202110130449.p0.git.8c077e4.assembly.rc.8, openshift4/ose-tests v4.9.0-202110011028.p0.git.6105395.assembly.stream, +190 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-cli v4.10.0-202202160843.p0.gf93da17.assembly.stream, openshift4/ose-pod v4.10.0-202202251728.p0.ge419edf.assembly.stream, openshift4/ose-etcd v4.10.0-202202160023.p0.g7bbf25a.assembly.stream, openshift4/ose-tests v4.10.0-202202221318.p0.gc1d9068.assembly.stream, openshift4/ose-console v4.10.0-202202240423.p0.gb6503ff.assembly.stream, openshift4/ose-coredns v4.10.0-202202160023.p0.g3ec1ee7.assembly.stream, +158 more Red Hat OpenShift Container Platform 4.11 openshift4/ose-cli v4.11.0-202209130958.p0.g5e53738.assembly.stream, openshift4/ose-pod v4.11.0-202209131648.p0.g3882f8f.assembly.stream, openshift4/ose-etcd v4.11.0-202209130958.p0.g80cc14e.assembly.stream, openshift4/ose-tests v4.11.0-202209140647.p0.geabfeaa.assembly.stream, openshift4/ose-console v4.11.0-202209130958.p0.ge83693f.assembly.stream, openshift4/ose-coredns v4.11.0-202209130958.p0.g7fe212f.assembly.stream, +175 more Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.43% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected packages

ecosystem package affected fixed in
go github.com/gogo/protobuf
<1.3.2
1.3.2
bitnami consul
<1.8.15
>=1.9.0, <1.9.9
>=1.10.0, <1.10.2
1.8.15
1.9.9
1.10.2
bitnami protobuf
<1.3.2
1.3.2

Classification

Weakness
  • CWE-129 Improper Validation of Array Index
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.