CVE-2021-33198 json
Panic on inputs with large exponents in math/big
published 2021-08-02 5 y ago modified 2026-09-08 2 mo ago also BIT-golang-2021-33198 , EUVD-2021-19911 , GO-2021-0242
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.4%
- EPSS 3.4% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
Patch / fix
- bitnami golang 1.15.13, 1.16.5
- go stdlib 1.15.13, 1.16.5
- golang go 1.15.13, 1.16.5
- golang-1.15 Debian 11 1.15.9-5
debian advisories DEBIAN-CVE-2021-33198
- crit RHEL 8 3.18-5.module+el8.10.0+22417+2fb00970
- criu RHEL 8 3.18-5.module+el8.10.0+22417+2fb00970
- crun RHEL 8 1.14.3-2.module+el8.10.0+22417+2fb00970
- runc RHEL 8 1:1.1.12-5.module+el8.10.0+22417+2fb00970
- udica RHEL 8 0.2.6-21.module+el8.10.0+22417+2fb00970
- conmon RHEL 8 3:2.1.10-1.module+el8.10.0+22417+2fb00970
- podman RHEL 8 4:4.9.4-18.module+el8.10.0+22417+2fb00970
- skopeo RHEL 8 2:1.14.5-3.module+el8.10.0+22417+2fb00970
red hat advisories RHSA-2024:10289RHSA-2024:2988RHSA-2024:2586RHSA-2021:4156RHSA-2022:8008RHSA-2021:3555
- go1.15 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +8 more 1.15.13-1.33.1
- go1.16 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.16.5-1.17.1
suse advisories SUSE-SU-2021:2214-1SUSE-SU-2021:2186-1
- go1.15 openSUSE Tumbleweed 1.15.15-1.2
- go1.16 openSUSE Tumbleweed 1.16.8-1.1
- go1.15 openSUSE Leap 15.2 1.15.13-lp152.20.1
- go1.15 openSUSE Leap 15.3 1.15.13-1.33.1
- go1.16 openSUSE Leap 15.3 1.16.5-1.17.1
opensuse advisories openSUSE-SU-2024:10808-1openSUSE-SU-2024:10809-1openSUSE-SU-2021:0950-1openSUSE-SU-2021:2214-1openSUSE-SU-2021:2186-1
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3901+4b80ecd7
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3858+6ad51f9f
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3926+f12484f5
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3909+6e1c1eb7
- crun AlmaLinux 8 1.14.3-2.module_el8.10.0+3845+87b84552
- crun AlmaLinux 8 1.14.3-2.module_el8.10.0+3909+6e1c1eb7
almalinux advisories ALSA-2024:10289ALSA-2022:7955ALSA-2022:8008ALSA-2021:4156
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1825+623b0c20
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1843+6892ab28
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1872+2e18eb19
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1874+ce489889
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1880+8e896d1b
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1896+b18fa106
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1948+4b5cd4a9
rocky linux advisories RLSA-2024:2988RLSA-2024:10289RLSA-2021:4156
- go Alpine 3.13 1.15.13-r0
- go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.5-r0
alpine advisories ALPINE-CVE-2021-33198
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- go Arch Linux 2:1.16.5-1
arch linux advisories AVG-2006
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-33198 updated cvss 7.5
golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-operator, +4 moreaffected: no fix available
-
Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Enterprise Linux 7 golang, skopeo, buildah, golang-bin, golang-src, golang-misc, +1 moreaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +4 moreaffected: no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 moreaffected: no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +4 moreaffected: no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8 Red Hat OpenShift Virtualization 2 node-maintenance-operator-container Red Hat OpenShift Virtualization 4 container-native-virtualization/cnv-must-gather-rhel8, container-native-virtualization/node-maintenance-operator, container-native-virtualization/vm-import-controller-rhel8, container-native-virtualization/kubevirt-template-validatoraffected: no fix available
-
Red Hat OpenStack Platform 16.1 golang-qpid-apache Red Hat OpenStack Platform 16.2 golang-qpid-apacheaffected: no fix planned “Will not fix”
-
Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +5 moreaffected: no fix available, no fix planned “Out of support scope”
show 20 moreshow fewer
-
Red Hat Service Telemetry Framework 1.2 for RHEL 8 smart-gateway-container Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8affected: no fix planned “Will not fix”
-
Red Hat CNV 2.6 for RHEL 7 kubevirt 2.6.10-230.el7, kubevirt-virtctl 2.6.10-230.el7, kubevirt-virtctl-redistributable 2.6.10-230.el7 Red Hat CNV 2.6 for RHEL 8 kubevirt 2.6.10-230.el8, kubevirt-virtctl 2.6.10-230.el8, kubevirt-virtctl-redistributable 2.6.10-230.el8fixed: vendor fix RHSA-2022:1402
-
Red Hat CNV 4.8 for RHEL 7 kubevirt 4.8.5-278.el7, kubevirt-virtctl 4.8.5-278.el7, kubevirt-virtctl-redistributable 4.8.5-278.el7 Red Hat CNV 4.8 for RHEL 8 kubevirt 4.8.5-278.el8, kubevirt-virtctl 4.8.5-278.el8, kubevirt-virtctl-redistributable 4.8.5-278.el8, container-native-virtualization/vm-import-operator-rhel8 v4.8.2-4fixed: vendor fix RHSA-2022:1329
-
Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/kubemacpool v4.9.0-19, container-native-virtualization/virt-cdi-cloner v4.9.0-37, container-native-virtualization/virt-cdi-importer v4.9.2-8, container-native-virtualization/virt-cdi-operator v4.9.0-37, container-native-virtualization/virt-cdi-apiserver v4.9.0-37, container-native-virtualization/virt-cdi-controller v4.9.0-37, +3 morefixed: vendor fix RHSA-2021:4104
-
Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-4.module+el8.9.0+20326+387084d0, criu 3.18-4.module+el8.9.0+20326+387084d0, crit 3.18-5.module+el8.10.0+22417+2fb00970, criu 3.18-5.module+el8.10.0+22417+2fb00970, delve 1.6.0-1.module+el8.5.0+10379+d6b83bd0, crun 1.14.3-2.module+el8.10.0+21340+c6c7475a, +68 morefixed: vendor fix RHSA-2024:2988
-
Red Hat Enterprise Linux AppStream (v. 9) skopeo 1.9.2-1.el9, buildah 1.27.0-2.el9, skopeo-tests 1.9.2-1.el9, buildah-tests 1.27.0-2.el9fixed: vendor fix RHSA-2022:8008
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) crit 3.15-1.module+el8.4.0+21529+674bace2, criu 3.15-1.module+el8.4.0+21529+674bace2, crun 0.18-2.module+el8.4.0+21529+674bace2, udica 0.2.4-1.module+el8.4.0+21529+674bace2, skopeo 1.2.2-9.module+el8.4.0+21529+674bace2, conmon 2.0.26-1.module+el8.4.0+21529+674bace2, +20 more Red Hat Enterprise Linux AppStream E4S (v.8.4) crit 3.15-1.module+el8.4.0+21529+674bace2, criu 3.15-1.module+el8.4.0+21529+674bace2, crun 0.18-2.module+el8.4.0+21529+674bace2, udica 0.2.4-1.module+el8.4.0+21529+674bace2, skopeo 1.2.2-9.module+el8.4.0+21529+674bace2, conmon 2.0.26-1.module+el8.4.0+21529+674bace2, +20 more Red Hat Enterprise Linux AppStream TUS (v.8.4) crit 3.15-1.module+el8.4.0+21529+674bace2, criu 3.15-1.module+el8.4.0+21529+674bace2, crun 0.18-2.module+el8.4.0+21529+674bace2, udica 0.2.4-1.module+el8.4.0+21529+674bace2, skopeo 1.2.2-9.module+el8.4.0+21529+674bace2, conmon 2.0.26-1.module+el8.4.0+21529+674bace2, +20 morefixed: vendor fix RHSA-2024:2586
-
Red Hat Migration Toolkit 1.5 rhmtc/openshift-velero-plugin-rhel8 v1.5.1-4, rhmtc/openshift-migration-velero-rhel8 v1.5.1-4, rhmtc/openshift-migration-registry-rhel8 v1.5.1-4, rhmtc/openshift-migration-must-gather-rhel8 v1.5.1-3, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 v1.5.1-4fixed: vendor fix RHSA-2021:3361
-
Red Hat OpenShift Container Platform 4.6 ignition 2.6.0-8.rhaos4.6.git947598e.el8, ignition-validate 2.6.0-8.rhaos4.6.git947598e.el8fixed: vendor fix RHSA-2021:3009
-
Red Hat OpenShift Container Platform 4.7 redhat-release-coreos 47.84-1.el8, cri-o 1.20.4-7.rhaos4.7.git6287500.el7, cri-o 1.20.4-7.rhaos4.7.git6287500.el8, ignition 2.9.0-4.rhaos4.7.git1d56dc8.el8, ignition-validate 2.9.0-4.rhaos4.7.git1d56dc8.el8, openshift 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7, +8 morefixed: vendor fix RHBA-2021:2979
-
Red Hat OpenShift Container Platform 4.8 cri-tools 1.21.0-3.el8, butane 0.12.1-2.rhaos4.8.el8, ignition 2.9.0-7.rhaos4.8.el8, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el7, cri-o 1.21.2-8.rhaos4.8.git8d4264e.el8, ignition-validate 2.9.0-7.rhaos4.8.el8, +138 morefixed: vendor fix RHSA-2021:3248
-
Red Hat OpenShift Container Platform 4.9 openshift4/ose-etcd v4.9.0-202109302317.p0.git.5c1feaf.assembly.streamfixed: vendor fix RHSA-2021:3759
-
Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator 5.0.0-5, openshift4-wincw/windows-machine-config-operator-bundle v5.0.0-5fixed: vendor fix RHSA-2022:0577
-
Red Hat OpenShift Data Foundation 4.9 on RHEL-8 mcg 5.9.0-28.61dcf87.5.9.el8, odf4/ocs-operator-bundle 4.9.0-5, odf4/odf-operator-bundle 4.9.0-5, odf4/odr-hub-operator-bundle 4.9.0-5, odf4/odr-cluster-operator-bundle 4.9.0-5, odf4/odf-multicluster-operator-bundle 4.9.0-5, +10 morefixed: vendor fix RHSA-2021:5085
-
Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.5-6, distributed-tracing/jaeger-query-rhel8 1.20.5-3, distributed-tracing/jaeger-ingester-rhel8 1.20.5-6, distributed-tracing/jaeger-rhel8-operator 1.20.5-5, distributed-tracing/jaeger-collector-rhel8 1.20.5-5, distributed-tracing/jaeger-all-in-one-rhel8 1.20.5-3fixed: vendor fix RHSA-2021:3229
-
Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.23.2-1.el8fixed: vendor fix RHSA-2021:3555
-
Red Hat OpenShift Serverless 1.17 openshift-serverless-1/client-kn-rhel8 0.23.2-2, openshift-serverless-1/serving-queue-rhel8 0.23.1-2, openshift-serverless-1/eventing-mtping-rhel8 0.23.0-5, openshift-serverless-1/kourier-control-rhel8 0.23.0-4, openshift-serverless-1/serving-webhook-rhel8 0.23.1-2, openshift-serverless-1/eventing-webhook-rhel8 0.23.0-5, +24 morefixed: vendor fix RHSA-2021:3556
-
Red Hat OpenStack Platform 16.1 etcd 3.3.23-3.1.el8ost.1fixed: vendor fix RHSA-2021:5072
-
Red Hat OpenStack Platform 16.2 etcd 3.3.23-3.1.el8ost.1fixed: vendor fix RHSA-2021:3487
-
Red Hat RHACS 3.64 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator 3.64.0-2fixed: vendor fix RHSA-2021:3146
17 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.37% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- groups.google.com https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.15.13 >=1.16.0, <1.16.5 |
1.15.13 1.16.5 |
| go | stdlib | <1.15.13 >=1.16.0-0, <1.16.5 |
1.15.13 1.16.5 |
References
-
groups.google.com
/g/golang-announce/c/RgCMkAEQjSI
exploit, patch, third-party-advisory, advisory, web
-
go.dev
/cl/316149
patch
-
go.googlesource.com
/go/+/6c591f79b0b5327549bd4e94970f7a279efb4ab0
patch
-
security.gentoo.org
/glsa/202208-02
vendor-advisory, third-party-advisory, advisory
-
groups.google.com
/g/golang-announce
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-33198
web
-
go.dev
/issue/45910
report
Sources
- CVE List CVE-2021-33198
- NVD CVE-2021-33198
- OSV BIT-golang-2021-33198
- OSV GO-2021-0242
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.