Skip to content
Fencer Vulns
medium 5.9

CVE-2020-15586 json

Data race and crash in net/http

published 2020-07-17 6 y ago modified 2026-09-08 2 mo ago also BIT-golang-2020-15586 , EUVD-2020-7573 , GO-2021-0224

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

Patch / fix

  • bitnami golang 1.13.13, 1.14.5
  • go stdlib 1.13.13, 1.14.5
  • golang go 1.13.13, 1.14.5
  • cloudfoundry cf-deployment 13.7.0
  • cloudfoundry routing-release 0.203.0
  • golang-1.15 Debian 11 1.15~rc1-1

debian advisories DEBIAN-CVE-2020-15586

  • delve RHEL 8 1.3.2-3.module+el8.2.0+5581+896cb53e
  • golang RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • go-toolset RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-bin RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-src RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-misc RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-race RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974
  • golang-tests RHEL 8 1.13.15-1.module+el8.2.0+7662+fa98b974

red hat advisories RHSA-2020:3665RHSA-2020:5606RHSA-2020:4297RHSA-2020:4214RHBA-2020:4197RHSA-2021:4103

  • go1.14 SLE Module for Development Tools 15 SP2, SLE Module for Development Tools 15 SP1 1.14.7-1.15.1

suse advisories SUSE-SU-2020:2562-1

  • go1.13 openSUSE Tumbleweed 1.13.15-2.6
  • go1.14 openSUSE Tumbleweed 1.14.15-1.6
  • go1.14 openSUSE Leap 15.2 1.14.7-lp152.2.3.1
  • go1.14 openSUSE Leap 15.1 1.14.7-lp151.13.1
  • go1.13 openSUSE Leap 15.2 1.13.14-lp152.2.4.1
  • go1.13 openSUSE Leap 15.1 1.13.14-lp151.5.1

opensuse advisories openSUSE-SU-2024:10806-1openSUSE-SU-2024:10807-1openSUSE-SU-2020:1407-1openSUSE-SU-2020:1405-1openSUSE-SU-2020:1095-1openSUSE-SU-2020:1087-1

  • go Alpine 3.12, Alpine 3.11 1.13.13-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.14.5-r0

alpine advisories ALPINE-CVE-2020-15586

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-tensorboard Azure Linux 3.0 2.16.2-1

azure linux advisories AZL-38206

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-15586 updated cvss 5.9

golang: data race in certain net/http servers including ReverseProxy can lead to DoS

  • Red Hat OpenShift Service Mesh 1 kiali, jaeger, jaeger-operator
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 apb, cri-o, podman, cockpit, heapster, cri-tools, +59 more
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift-golang-builder-container
    affected: no fix available
  • Red Hat OpenShift Virtualization 1 golang, kubevirt-cdi, kubevirt-virtctl
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Virtualization 2 kubevirt, virt-api, kubemacpool, virt-handler, bridge-marker, virt-launcher, +25 more
    affected: no fix available
show 17 more
  • Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +7 more
    affected: no fix available “Fix deferred”
  • Red Hat CNV 2.4 for RHEL 8 container-native-virtualization/kubevirt-cpu-node-labeller v2.4.2-1, container-native-virtualization/vm-import-controller-rhel8 v2.4.2-1, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.4.2-1, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.4.2-1
    fixed: vendor fix RHSA-2020:4201
  • Red Hat CNV 4.9 for RHEL 7 kubevirt 4.9.0-287.el7, kubevirt-virtctl 4.9.0-287.el7, kubevirt-virtctl-redistributable 4.9.0-287.el7 Red Hat CNV 4.9 for RHEL 8 kubevirt 4.9.0-287.el8, kubevirt-virtctl 4.9.0-287.el8, kubevirt-virtctl-redistributable 4.9.0-287.el8
    fixed: vendor fix RHSA-2021:4103
  • Red Hat OpenShift Logging 5.0 openshift-logging/eventrouter-rhel8 v5.0.3-1
    fixed: vendor fix RHSA-2021:1515
  • Red Hat OpenShift Serverless 1.9.0
    fixed: vendor fix RHSA-2021:0072
  • Red Hat OpenShift Service Mesh 1.0 openshift-service-mesh/3scale-istio-adapter-rhel8 1.0.0-9
    fixed: vendor fix RHBA-2020:4139
  • Red Hat OpenShift Service Mesh 1.1 ior 1.1.11-2.el8, servicemesh 1.1.11-2.el8, servicemesh-cni 1.1.11-2.el8, servicemesh-mixc 1.1.11-2.el8, servicemesh-mixs 1.1.11-2.el8, servicemesh-galley 1.1.11-2.el8, +9 more
    fixed: vendor fix RHSA-2020:5649
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.13 1.13.15-1.el7, go-toolset-1.13-build 1.13.15-1.el7, go-toolset-1.13-golang 1.13.15-3.el7, go-toolset-1.13-runtime 1.13.15-1.el7, go-toolset-1.13-golang-bin 1.13.15-3.el7, go-toolset-1.13-golang-src 1.13.15-3.el7, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.13 1.13.15-1.el7, go-toolset-1.13-build 1.13.15-1.el7, go-toolset-1.13-golang 1.13.15-3.el7, go-toolset-1.13-runtime 1.13.15-1.el7, go-toolset-1.13-golang-bin 1.13.15-3.el7, go-toolset-1.13-golang-src 1.13.15-3.el7, +3 more
    fixed: vendor fix RHSA-2020:4214
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.3.2-3.module+el8.2.0+5581+896cb53e, golang 1.13.15-1.module+el8.2.0+7662+fa98b974, go-toolset 1.13.15-1.module+el8.2.0+7662+fa98b974, golang-bin 1.13.15-1.module+el8.2.0+7662+fa98b974, golang-src 1.13.15-1.module+el8.2.0+7662+fa98b974, golang-misc 1.13.15-1.module+el8.2.0+7662+fa98b974, +2 more
    fixed: vendor fix RHSA-2020:3665
  • Red Hat OpenShift Container Platform 4.4 faq 0.0.6-5.el7, openshift 4.4.0-202011130111.p0.git.0.4861dfa.el7, openshift 4.4.0-202011130111.p0.git.0.4861dfa.el8, openshift-hyperkube 4.4.0-202011130111.p0.git.0.4861dfa.el7, openshift-hyperkube 4.4.0-202011130111.p0.git.0.4861dfa.el8, openshift-clients 4.4.0-202011122017.p0.git.3445.6937a03.el7, +3 more
    fixed: vendor fix RHBA-2020:5123
  • Red Hat OpenShift Container Platform 4.5 apb 2.0.3-3.el7, cri-tools 1.18.0-4.el7, cri-tools 1.18.0-4.el8, podman 1.9.3-2.rhaos4.5.el8, skopeo 1.1.1-2.rhaos4.5.el8, buildah 1.11.6-9.rhaos4.5.el8, +104 more
    fixed: vendor fix RHSA-2021:0713
  • Red Hat OpenShift Container Platform 4.6 podman 1.9.3-3.rhaos4.6.el8, skopeo 1.1.1-3.rhaos4.6.el8, podman-tests 1.9.3-3.rhaos4.6.el8, skopeo-tests 1.1.1-3.rhaos4.6.el8, podman-docker 1.9.3-3.rhaos4.6.el8, podman-remote 1.9.3-3.rhaos4.6.el8, +12 more
    fixed: vendor fix RHBA-2020:4197
  • Red Hat OpenShift Container Platform 4.7 cri-tools 1.20.0-3.el7, redhat-release-coreos 47.83-2.el8, jenkins-2-plugins 4.7.1621361158-1.el8, cri-o 1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o 1.20.2-12.rhaos4.7.git9f7be76.el8, prometheus-promu 0.5.0-3.git642a960.el8, +1 more
    fixed: vendor fix RHSA-2021:2122
  • Red Hat OpenShift Container Storage 4.6 on RHEL-8 mcg 5.6.0-39.2279a46.5.6.el8, ocs4/mcg-rhel8-operator 5.6.0-39.2279a46.5.6, ocs4/cephcsi-rhel8 4.6-52.49cf5efdd.release_4.6, ocs4/ocs-rhel8-operator 4.6-76.0811c33c.release_4.6, ocs4/ocs-must-gather-rhel8 4.6-76.0811c33c.release_4.6, ocs4/rook-ceph-rhel8-operator 4.6-80.1ae5ac6a.release_4.6
    fixed: vendor fix RHSA-2020:5606
  • Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel8 1.17.8-12, distributed-tracing/jaeger-query-rhel8 1.17.8-10, distributed-tracing/jaeger-ingester-rhel8 1.17.8-12, distributed-tracing/jaeger-rhel8-operator 1.17.8-11, distributed-tracing/jaeger-collector-rhel8 1.17.8-10, distributed-tracing/jaeger-all-in-one-rhel8 1.17.8-12, +2 more
    fixed: vendor fix RHBA-2021:0075
  • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8 1.20.2-2, distributed-tracing/jaeger-query-rhel8 1.20.2-2, distributed-tracing/jaeger-ingester-rhel8 1.20.2-2, distributed-tracing/jaeger-rhel8-operator 1.20.2-2, distributed-tracing/jaeger-collector-rhel8 1.20.2-3, distributed-tracing/jaeger-all-in-one-rhel8 1.20.2-2, +2 more
    fixed: vendor fix RHBA-2021:0101
  • Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.3-1, openshift-logging/kibana6-rhel8 v5.0.3-1, openshift-logging/elasticsearch6-rhel8 v5.0.3-1, openshift-logging/logging-curator5-rhel8 v5.0.3-1, openshift-logging/elasticsearch-proxy-rhel8 v5.0.3-1, openshift-logging/elasticsearch-rhel8-operator v5.0.3-2, +3 more Red Hat OpenShift Container Platform 4.4 iptables 1.8.4-10.el8_2.4, iptables-libs 1.8.4-10.el8_2.4, iptables-utils 1.8.4-10.el8_2.4, iptables-ebtables 1.8.4-10.el8_2.4, iptables-services 1.8.4-10.el8_2.4, iptables-arptables 1.8.4-10.el8_2.4, +5 more Red Hat OpenShift Container Platform 4.5 faq 0.0.6-5.el7, perf 4.18.0-193.24.1.el8_2.dt1, kernel 4.18.0-193.24.1.el8_2.dt1, bpftool 4.18.0-193.24.1.el8_2.dt1, kernel-core 4.18.0-193.24.1.el8_2.dt1, kernel-tools 4.18.0-193.24.1.el8_2.dt1, +68 more Red Hat OpenShift Container Platform 4.6 jq 1.6-2.el7, jq 1.6-2.el8, faq 0.0.6-4.el8, ostree 2020.5-4.el8, pprof 2.6.3-2.el8+7, tini 0.16.1-1.el8ar, +300 more Red Hat OpenShift Container Platform 4.6 for System Z over RHEL 8 s390utils 2.6.0-28.el8_2.2, s390utils-base 2.6.0-28.el8_2.2, s390utils-cmsfs 2.6.0-28.el8_2.2, s390utils-zdsfs 2.6.0-28.el8_2.2, s390utils-ziomon 2.6.0-28.el8_2.2, s390utils-cpuplugd 2.6.0-28.el8_2.2, +6 more Red Hat OpenShift Container Platform 4.7 openshift 4.7.0-202104250659.p0.git.7d0a2b2.el7, openshift 4.7.0-202104250659.p0.git.7d0a2b2.el8, openshift-kuryr 4.7.0-202104250659.p0.git.d49acc4.el8, openshift-ansible 4.7.0-202104250659.p0.git.e1b19c2.el7, openshift-clients 4.7.0-202104250659.p0.git.95881af.el7, openshift-clients 4.7.0-202104250659.p0.git.95881af.el8, +10 more
    +2 more products
    Red Hat OpenShift Container Storage 4.6 on RHEL-8 tini 0.18.0-5.el8, ocs4/ocs-operator-bundle 4.6.0-7, ocs4/mcg-core-rhel8 5.6.0-38.31e0c3c7b.5.6 Red Hat OpenShift Virtualization 2 cnv-must-gather
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.88% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.13.13
>=1.14.0, <1.14.5
1.13.13
1.14.5
go stdlib
<1.13.13
>=1.14.0-0, <1.14.5
1.13.13
1.14.5

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.