Skip to content
Fencer Vulns
medium 5.9

CVE-2021-36221 json

Panic in ReverseProxy in net/http/httputil

published 2021-08-08 5 y ago modified 2026-10-16 24 d ago also BIT-golang-2021-36221 , EUVD-2021-22841 , GO-2021-0245

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Patch / fix

  • bitnami golang 1.15.15, 1.16.7
  • go stdlib 1.15.15, 1.16.7
  • golang go 1.15.15, 1.16.7
  • oracle timesten_in-memory_database 21.1.1.1.0
  • siemens scalance_lpe9403_firmware 2.0
  • golang-1.15 Debian 11 1.15.15-1~deb11u1

debian advisories DEBIAN-CVE-2021-36221

  • crit RHEL 8 3.15-3.module+el8.7.0+16772+33343656
  • criu RHEL 8 3.15-3.module+el8.7.0+16772+33343656
  • crun RHEL 8 1.5-1.module+el8.7.0+16772+33343656
  • runc RHEL 8 1:1.1.4-1.module+el8.7.0+16772+33343656
  • udica RHEL 8 0.2.6-3.module+el8.7.0+16772+33343656
  • conmon RHEL 8 3:2.1.4-1.module+el8.7.0+16772+33343656
  • podman RHEL 8 3:4.2.0-1.module+el8.7.0+16772+33343656
  • skopeo RHEL 8 2:1.9.2-1.module+el8.7.0+16772+33343656

red hat advisories RHSA-2022:7457RHSA-2021:4156RHSA-2022:1361RHSA-2022:1276RHSA-2022:0557RHSA-2021:4765

  • go1.16 SLE Module for Development Tools 15 SP3, SLE Module for Development Tools 15 SP2 1.16.7-1.23.1
  • go1.15 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +8 more 1.15.15-1.39.1

suse advisories SUSE-SU-2021:2788-1SUSE-SU-2021:2787-1

  • go1.15 openSUSE Tumbleweed 1.15.15-1.2
  • go1.16 openSUSE Tumbleweed 1.16.8-1.1
  • go1.15 openSUSE Leap 15.2 1.15.15-lp152.26.1
  • go1.16 openSUSE Leap 15.2 1.16.7-lp152.8.1
  • go1.16 openSUSE Leap 15.3 1.16.7-1.23.1
  • go1.15 openSUSE Leap 15.3 1.15.15-1.39.1

opensuse advisories openSUSE-SU-2024:10808-1openSUSE-SU-2024:10809-1openSUSE-SU-2021:1207-1openSUSE-SU-2021:1199-1openSUSE-SU-2021:2788-1openSUSE-SU-2021:2787-1

  • delve AlmaLinux 8 1.6.0-1.module_el8.5.0+2604+960c7771

almalinux advisories ALSA-2021:4156

  • criu Rocky Linux 8 3.15-3.module+el8.7.0+1077+0e4f03d4
  • criu Rocky Linux 8 3.15-3.module+el8.5.0+710+4c471e88
  • criu Rocky Linux 8 3.15-3.module+el8.6.0+1054+50b00ff4
  • crun Rocky Linux 8 1.5-1.module+el8.7.0+1077+0e4f03d4
  • crun Rocky Linux 8 1.5-1.module+el8.6.0+1054+50b00ff4
  • runc Rocky Linux 8 1:1.1.4-1.module+el8.7.0+1077+0e4f03d4
  • udica Rocky Linux 8 0.2.6-3.module+el8.7.0+1077+0e4f03d4
  • udica Rocky Linux 8 0.2.6-3.module+el8.6.0+971+69b94baf

rocky linux advisories RLSA-2022:7457RLSA-2021:4156

  • go Alpine 3.13 1.15.15-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.16.7-r0

alpine advisories ALPINE-CVE-2021-36221

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.16.7-1

arch linux advisories AVG-2259

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-36221 updated cvss 5.9

golang: net/http/httputil: panic due to racy read of persistConn after handler panic

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-operator, servicemesh-grafana-prometheus
    affected: workaround, no fix available
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Enterprise Linux 7 golang, buildah, golang-bin, golang-src, golang-misc, golang-tests Red Hat Enterprise Linux 8 buildah, buildah-tests
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 buildah, buildah-tests
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +4 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator
    affected: workaround, no fix available
  • Red Hat OpenShift Virtualization 2 kubevirt, virt-api-container, virt-handler-container, virt-launcher-container, virt-operator-container, ovs-cni-marker-container, +18 more Red Hat OpenShift Virtualization 4 kubevirt, container-native-virtualization/virt-api, container-native-virtualization/virt-handler, container-native-virtualization/virt-launcher, container-native-virtualization/virt-operator, container-native-virtualization/ovs-cni-marker, +11 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.1 etcd, golang-github-infrawatch-apputils Red Hat OpenStack Platform 16.2 etcd, golang-github-infrawatch-apputils
    affected: workaround, no fix planned “Will not fix”
show 14 more
  • Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator
    affected: workaround, no fix available
  • Red Hat Storage 3 golang, heketi, grafana, golang-bin, golang-src, golang-misc, +4 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Service Telemetry Framework 1.2 for RHEL 8 smart-gateway-container Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-cdi-cloner v4.9.4-7, container-native-virtualization/virt-cdi-operator v4.9.4-7, container-native-virtualization/virt-cdi-apiserver v4.9.4-7, container-native-virtualization/virt-cdi-controller v4.9.4-7, container-native-virtualization/virt-cdi-uploadproxy v4.9.4-7, container-native-virtualization/virt-cdi-uploadserver v4.9.4-7
    fixed: vendor fix RHEA-2022:1596
  • Red Hat OpenShift Sandboxed Containers 1.2.0 openshift-sandboxed-containers/osc-rhel8-operator 1.2.0-14
    fixed: vendor fix RHSA-2022:0855
  • Red Hat OpenShift Service Mesh 2.0 servicemesh 2.0.9-3.el8, servicemesh-mixc 2.0.9-3.el8, servicemesh-mixs 2.0.9-3.el8, servicemesh-istioctl 2.0.9-3.el8, servicemesh-pilot-agent 2.0.9-3.el8, servicemesh-prometheus 2.14.0-16.el8.1, +1 more
    fixed: vendor fix RHSA-2022:1276
  • Red Hat Enterprise Linux AppStream (v. 8) crun 1.5-1.module+el8.7.0+16772+33343656, crit 3.15-3.module+el8.7.0+16772+33343656, criu 3.15-3.module+el8.7.0+16772+33343656, runc 1.1.4-1.module+el8.7.0+16772+33343656, delve 1.6.0-1.module+el8.5.0+10379+d6b83bd0, udica 0.2.6-3.module+el8.7.0+16772+33343656, +35 more
    fixed: vendor fix RHSA-2021:4156
  • Red Hat Migration Toolkit 1.5 rhmtc/openshift-velero-plugin-rhel8 v1.5.4-8, rhmtc/openshift-migration-velero-rhel8 v1.5.4-8, rhmtc/openshift-migration-registry-rhel8 v1.5.4-9, rhmtc/openshift-migration-must-gather-rhel8 v1.5.4-7, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8 v1.5.4-7, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 v1.5.4-6
    fixed: vendor fix RHSA-2022:1396
  • Red Hat OpenShift Container Platform 4.9 cri-tools 1.22.0-2.el8, ignition 2.12.0-3.rhaos4.9.el8, cri-o 1.22.1-17.rhaos4.9.git3029b1d.el7, ignition-validate 2.12.0-3.rhaos4.9.el8, cri-o 1.22.1-17.rhaos4.9.git3029b1d.2.el8, openshift 4.9.0-202202111950.p0.gb93fd35.assembly.stream.el7, +148 more
    fixed: vendor fix RHSA-2022:0557
  • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator 5.0.0-5, openshift4-wincw/windows-machine-config-operator-bundle v5.0.0-5
    fixed: vendor fix RHSA-2022:0577
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 0.25.1-1.el8
    fixed: vendor fix RHSA-2021:4765
  • Red Hat OpenShift Serverless 1.19 openshift-serverless-1/client-kn-rhel8 0.25.1-1, openshift-serverless-1/serving-queue-rhel8 0.25.1-1, openshift-serverless-1/eventing-mtping-rhel8 0.25.0-2, openshift-serverless-1/kourier-control-rhel8 0.25.0-1, openshift-serverless-1/serving-webhook-rhel8 0.25.1-1, openshift-serverless-1/eventing-webhook-rhel8 0.25.0-2, +24 more
    fixed: vendor fix RHSA-2021:4766
  • Red Hat RHODF 4.10 for RHEL 8 mcg 5.10.0-72.el8, odf4/cephcsi-rhel8 v4.10.0-35, odf4/mcg-core-rhel8 v4.10.0-12, mcg-redistributable 5.10.0-72.el8, odf4/odf-console-rhel8 v4.10.0-27, odf4/odf-topolvm-rhel8 v4.10.0-16, +20 more
    fixed: vendor fix RHSA-2022:1361
  • Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-api v4.9.4-7, container-native-virtualization/virtio-win v4.9.4-5, container-native-virtualization/kubemacpool v4.9.4-5, container-native-virtualization/virt-handler v4.9.4-7, container-native-virtualization/bridge-marker v4.9.4-5, container-native-virtualization/virt-launcher v4.9.4-7, +24 more Red Hat OpenShift Sandboxed Containers 1.2.0 openshift-sandboxed-containers/osc-monitor-rhel8 1.2.0-9, openshift-sandboxed-containers/osc-operator-bundle 1.2.0-19, openshift-sandboxed-containers/osc-must-gather-rhel8 1.2.0-10 Red Hat OpenShift Service Mesh 2.0 kiali v1.24.7.redhat1-1.el8, servicemesh-cni 2.0.9-3.el8, servicemesh-proxy 2.0.9-3.el8, servicemesh-operator 2.0.9-3.el8 Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat Migration Toolkit 1.5 rhmtc/openshift-migration-ui-rhel8 v1.5.4-7, rhmtc/openshift-migration-controller-rhel8 v1.5.4-7, rhmtc/openshift-migration-log-reader-rhel8 v1.5.4-8, rhmtc/openshift-migration-operator-bundle v1.5.4-16, rhmtc/openshift-migration-rsync-transfer-rhel8 v1.5.4-5, rhmtc/openshift-migration-legacy-rhel8-operator v1.5.4-17, +2 more
    +6 more products
    Red Hat OpenShift Container Platform 4.9 ovn21.12 21.12.0-25.el8fdp, butane 0.13.1-2.rhaos4.9.el8, ovn21.12-host 21.12.0-25.el8fdp, ovn21.12-vtep 21.12.0-25.el8fdp, ovn21.12-central 21.12.0-25.el8fdp, jenkins-2-plugins 4.9.1644822177-1.el8, +10 more Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Container Storage 4 ocs4/ocs-must-gather-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-all-in-one-rhel8 Red Hat OpenShift Virtualization 2 kubemacpool-container, bridge-marker-container, ovs-cni-plugin-container, cnv-must-gather-container, hostpath-provisioner-container, kubernetes-nmstate-handler-container, +2 more Red Hat OpenShift Virtualization 4 container-native-virtualization/kubemacpool, container-native-virtualization/bridge-marker, container-native-virtualization/ovs-cni-plugin, container-native-virtualization/cnv-must-gather-rhel8, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/cnv-containernetworking-plugins, +2 more
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-167-09 updated cvss 5.9

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

3.11% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.15.15
>=1.16.0, <1.16.7
1.15.15
1.16.7
go stdlib
<1.15.15
>=1.16.0-0, <1.16.7
1.15.15
1.16.7

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.