high 7.5

CVE-2021-38561 json

golang.org/x/text/language Out-of-bounds Read vulnerability

published 2021-10-06 5 y ago modified 2026-09-10 1 mo ago also GHSA-ppp9-7jff-5vj2 , GO-2021-0113 , EUVD-2022-7707

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Patch / fix

fixed in 2 distros 6 links 3

go golang.org/x/text 0.3.7
golang text 0.3.7

debian ubuntu red hat opensuse alpine azure linux

golang-golang-x-text Debian 14, Debian 13, Debian 12 0.3.7-1

debian advisories DEBIAN-CVE-2021-38561

golang-x-text Ubuntu 18.04 LTS 0.0~git20170627.0.6353ef0-1ubuntu2.1
golang-golang-x-text Ubuntu 20.04 LTS 0.3.2-4ubuntu0.1
golang-golang-x-text Ubuntu 22.04 LTS 0.3.7-1

ubuntu advisories UBUNTU-CVE-2021-38561

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kubevirt container native virtualization 4.12 4.12.0-1057.el7
kubevirt container native virtualization 4.12 4.12.0-1057.el8
kubevirt-virtctl container native virtualization 4.12 4.12.0-1057.el7
kubevirt-virtctl container native virtualization 4.12 4.12.0-1057.el8
kubevirt-virtctl-redistributable container native virtualization 4.12 4.12.0-1057.el7
kubevirt-virtctl-redistributable container native virtualization 4.12 4.12.0-1057.el8
cri-o openshift 4.11 1.24.5-2.rhaos4.11.gitb007cb6.el8
haproxy openshift 4.11 2.2.24-3.rhaos4.11.el8

red hat advisories RHSA-2023:0407 RHBA-2023:1649

cni openSUSE Tumbleweed 1.1.2-2.1
gitleaks openSUSE Tumbleweed 8.18.3-1.1

opensuse advisories openSUSE-SU-2024:12599-1 openSUSE-SU-2024:14015-1

git-lfs Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 3.1.2-r3

alpine advisories ALPINE-CVE-2021-38561

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

multus Azure Linux 3.0 4.0.2-1
cni Azure Linux 3.0 1.1.2-2
podman Azure Linux 3.0 5.6.1-2
buildah Azure Linux 3.0 1.41.4-2
containernetworking-plugins Azure Linux 3.0 1.6.1-4

azure linux advisories AZL-41221 AZL-41469 AZL-44622 AZL-44952 AZL-45375

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f commit
go.dev/cl/340830 patch
deps.dev/advisory/OSV/GO-2021-0113 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-38561 updated 2026-11-07 cvss 7.5

golang: out-of-bounds read in golang.org/x/text/language leads to DoS

Red Hat OpenShift Developer Tools and Services odo
affected: no fix available “Fix deferred”
Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-cni, servicemesh-mixc, servicemesh-mixs, servicemesh-istioctl, servicemesh-pilot-agent, +1 more
affected: no fix available
Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-pilot-agent, servicemesh-pilot-discovery
affected: no fix planned “Will not fix”
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/work-rhel8, rhacm2/subctl-rhel9, rhacm2/thanos-rhel7, rhacm2/acmesolver-rhel8, rhacm2/cainjector-rhel8, rhacm2/agent-service-rhel8, +22 more
affected: no fix available, no fix planned “Will not fix”
Red Hat Enterprise Linux 7 podman
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +6 more
affected: no fix available, no fix planned “Will not fix”
Red Hat Enterprise Linux 9 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +5 more
affected: no fix planned “Will not fix”
Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, ansible-service-broker, atomic-openshift-tests, atomic-openshift-master, +19 more
affected: no fix planned “Out of support scope”

show 20 more

Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +27 more
affected: no fix available, no fix planned “Will not fix”
Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8
affected: no fix planned “Out of support scope”
Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9, odf4/ocs-rhel9-operator
affected: no fix available
Red Hat OpenShift Virtualization 2 virt-api-container, kubemacpool-container, virt-handler-container, bridge-marker-container, virt-launcher-container, virt-operator-container, +17 more
affected: no fix planned “Out of support scope”
Red Hat OpenShift Virtualization 4 container-native-virtualization/vm-import-virtv2v-rhel8, container-native-virtualization/vm-import-operator-rhel8, container-native-virtualization/vm-import-controller-rhel8, container-native-virtualization/kubernetes-nmstate-handler-rhel8
affected: no fix planned “Will not fix”
Red Hat Quay 3 quay/quay-rhel8
affected: no fix available
Red Hat Storage 3 rhgs3/rhgs-gluster-block-prov-rhel7
affected: no fix planned “Out of support scope”
Red Hat CNV 4.11 for RHEL 8 container-native-virtualization/hostpath-csi-driver v4.11.0-21, container-native-virtualization/hostpath-csi-driver-rhel8 v4.11.0-21
fixed: vendor fix RHSA-2022:6526
Red Hat CNV 4.12 for RHEL 7 kubevirt 4.12.0-1057.el7, kubevirt-virtctl 4.12.0-1057.el7, kubevirt-virtctl-redistributable 4.12.0-1057.el7 Red Hat CNV 4.12 for RHEL 8 kubevirt 4.12.0-1057.el8, kubevirt-virtctl 4.12.0-1057.el8, kubevirt-virtctl-redistributable 4.12.0-1057.el8, container-native-virtualization/virt-api v4.12.6-2, container-native-virtualization/virt-api v4.12.0-255, container-native-virtualization/virtio-win v4.12.6-2, +48 more
fixed: vendor fix RHSA-2023:0407
Red Hat OpenShift Developer Tools and Services for OCP 4.7 for RHEL 8 ocp-tools-4/service-binding-rhel8-operator v1.1.1-3, ocp-tools-4/service-binding-operator-bundle v1.1.1-4
fixed: vendor fix RHSA-2022:5525
Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch-rhel8-operator v5.2.13-1
fixed: vendor fix RHSA-2022:5909
Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch-rhel8-operator v5.3.10-1
fixed: vendor fix RHSA-2022:5908
Red Hat OpenShift Container Platform 4.6 openshift4/ose-elasticsearch-proxy v4.6.0-202208241715.p0.gc1a3e95.assembly.stream, openshift4/ose-elasticsearch-operator v4.6.0-202208241715.p0.g23ab6b1.assembly.stream
fixed: vendor fix RHSA-2022:6263
Red Hat OpenShift Container Platform 4.9 openshift4/ose-ptp-operator v4.9.0-202208250215.p0.gb42ea81.assembly.stream, openshift4/ptp-must-gather-rhel8 v4.9.0-202208241755.p0.gb42ea81.assembly.stream
fixed: vendor fix RHSA-2022:6318
Red Hat OpenShift Container Platform 4.11 haproxy 2.2.24-3.rhaos4.11.el8, haproxy22 2.2.24-3.rhaos4.11.el8, cri-o 1.24.5-2.rhaos4.11.gitb007cb6.el8, kernel-rt 4.18.0-372.51.1.rt7.208.el8_6, kernel-rt-kvm 4.18.0-372.51.1.rt7.208.el8_6, kernel-rt-core 4.18.0-372.51.1.rt7.208.el8_6, +209 more
fixed: vendor fix RHBA-2023:1649
Red Hat OpenShift Container Platform 4.12 openshift4/ose-installer v4.12.0-202301090455.p0.gba94031.assembly.stream, openshift4/ose-multus-cni v4.12.0-202303202115.p0.gd59f94d.assembly.stream, openshift4/ose-aws-ebs-csi-driver-rhel8 v4.12.0-202301042354.p0.g1584117.assembly.stream, openshift4/ose-vsphere-csi-driver-rhel8 v4.12.0-202301042354.p0.gdf89e30.assembly.stream, openshift4/ose-network-metrics-daemon-rhel8 v4.12.0-202302201115.p0.gccff7e7.assembly.stream, openshift4/ose-vmware-vsphere-csi-driver-rhel8 v4.12.0-202301042354.p0.gdf89e30.assembly.stream, +2 more
fixed: vendor fix RHSA-2022:7399
Red Hat OpenShift Container Platform 4.13 openshift4/ose-multus-cni v4.13.0-202304190216.p0.g3f9b2d0.assembly.stream, openshift4/ose-node-feature-discovery v4.13.0-202304190216.p0.gaf570d4.assembly.stream
fixed: vendor fix RHSA-2023:1326
Red Hat RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-rhel8-operator v5.4.3-12
fixed: vendor fix RHSA-2022:5556
Red Hat RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator v5.5.0-57
fixed: vendor fix RHSA-2022:6051
Red Hat CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework v4.11.0-67, container-native-virtualization/kubevirt-console-plugin v4.11.0-83, container-native-virtualization/vm-network-latency-checkup v4.11.0-67, container-native-virtualization/kubevirt-tekton-tasks-operator v4.11.0-29, container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm v4.11.0-7, container-native-virtualization/kubevirt-tekton-tasks-copy-template v4.11.0-7, +6 more Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virtio-win v4.12.0-10, container-native-virtualization/kubemacpool v4.12.0-24, container-native-virtualization/bridge-marker v4.12.0-24, container-native-virtualization/ovs-cni-marker v4.12.0-24, container-native-virtualization/ovs-cni-plugin v4.12.0-24, container-native-virtualization/virt-cdi-cloner v4.12.0-72, +29 more Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch-proxy-rhel8 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-restic-restore-helper-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-must-gather-api-rhel8 Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-velero-restic-restore-helper-rhel8

+6 more productsfewer

Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-204, openshift-logging/kibana6-rhel8 v6.8.1-248, openshift-logging/elasticsearch6-rhel8 v6.8.1-216, openshift-logging/logging-curator5-rhel8 v5.8.1-195, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-246, openshift-logging/elasticsearch-operator-bundle v5.2.13-9, +3 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-206, openshift-logging/kibana6-rhel8 v6.8.1-247, openshift-logging/elasticsearch6-rhel8 v6.8.1-215, openshift-logging/logging-curator5-rhel8 v5.8.1-194, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-247, openshift-logging/cluster-logging-rhel8-operator v5.3.10-2, +3 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat OpenShift Container Platform 4 cri-tools, openshift4/ose-grafana, atomic-openshift-service-idler, openshift4/ose-local-storage-diskmaker, openshift4/ose-local-storage-rhel9-operator, openshift4/ose-local-storage-mustgather-rhel8, +1 more Red Hat OpenShift Container Platform 4.6 openshift4/ose-ptp v4.6.0-202208241715.p0.g8f5a67a.assembly.stream, openshift4/ose-sriov-cni v4.6.0-202208241715.p0.gd209fd9.assembly.stream, openshift4/ose-ghostunnel v4.6.0-202208241715.p0.gf048851.assembly.stream, openshift4/ose-descheduler v4.6.0-202208241715.p0.g4c0ed6d.assembly.stream, openshift4/ose-ptp-operator v4.6.0-202208241715.p0.g97081b3.assembly.stream, openshift4/ose-egress-router v4.6.0-202208241715.p0.g618b71d.assembly.stream, +38 more

not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-04-14)

Exploit prediction

1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
go	golang.org/x/text	<0.3.7	0.3.7

Classification

Weakness

CWE-125 Out-of-bounds Read

References

go.googlesource.com /text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
web, mailing-list, patch, vendor-advisory
deps.dev /advisory/OSV/GO-2021-0113
web, patch, third-party-advisory
go.dev /cl/340830
web, patch
pkg.go.dev /golang.org/x/text/language
web, product, vendor-advisory
groups.google.com /g/golang-announce
web, mailing-list, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-38561
advisory
pkg.go.dev /vuln/GO-2021-0113
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary