Search for vulnerabilities
Vulnerability details: VCID-2ps9-t61s-aaan
Vulnerability ID VCID-2ps9-t61s-aaan
Aliases CVE-2021-33196
Summary In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-400 Uncontrolled Resource Consumption
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2634
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2704
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2705
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2983
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2984
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3076
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3361
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3555
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3556
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3758
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33196.json
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00019 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00516 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00516 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00516 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
epss 0.00517 https://api.first.org/data/v1/epss?cve=CVE-2021-33196
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1965503
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.3 https://groups.google.com/g/golang-announce
generic_textual MODERATE https://groups.google.com/g/golang-announce
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2021-33196
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-33196
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-33196
archlinux Medium https://security.archlinux.org/AVG-2006
cvssv3.1 5.3 https://security.gentoo.org/glsa/202208-02
generic_textual MODERATE https://security.gentoo.org/glsa/202208-02
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33196.json
https://api.first.org/data/v1/epss?cve=CVE-2021-33196
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33196
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://groups.google.com/g/golang-announce
https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
https://security.gentoo.org/glsa/202208-02
1965503 https://bugzilla.redhat.com/show_bug.cgi?id=1965503
989492 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989492
ASA-202106-42 https://security.archlinux.org/ASA-202106-42
AVG-2006 https://security.archlinux.org/AVG-2006
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2021-33196 https://nvd.nist.gov/vuln/detail/CVE-2021-33196
RHSA-2021:2634 https://access.redhat.com/errata/RHSA-2021:2634
RHSA-2021:2704 https://access.redhat.com/errata/RHSA-2021:2704
RHSA-2021:2705 https://access.redhat.com/errata/RHSA-2021:2705
RHSA-2021:2983 https://access.redhat.com/errata/RHSA-2021:2983
RHSA-2021:2984 https://access.redhat.com/errata/RHSA-2021:2984
RHSA-2021:3076 https://access.redhat.com/errata/RHSA-2021:3076
RHSA-2021:3229 https://access.redhat.com/errata/RHSA-2021:3229
RHSA-2021:3361 https://access.redhat.com/errata/RHSA-2021:3361
RHSA-2021:3555 https://access.redhat.com/errata/RHSA-2021:3555
RHSA-2021:3556 https://access.redhat.com/errata/RHSA-2021:3556
RHSA-2021:3758 https://access.redhat.com/errata/RHSA-2021:3758
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33196.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://groups.google.com/g/golang-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33196
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33196
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33196
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://security.gentoo.org/glsa/202208-02
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02725
EPSS Score 0.00017
Published At May 10, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.