Search for vulnerabilities
Vulnerability details: VCID-h89x-2eq9-aaar
Vulnerability ID VCID-h89x-2eq9-aaar
Aliases CVE-2021-38561
GHSA-ppp9-7jff-5vj2
Summary golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-125 Out-of-bounds Read
CWE-20 Improper Input Validation
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5070
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5525
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5556
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5908
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5909
rhas Important https://access.redhat.com/errata/RHSA-2022:6051
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-38561.json
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2021-38561
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2100495
cvssv3.1 7.5 https://deps.dev/advisory/OSV/GO-2021-0113
generic_textual HIGH https://deps.dev/advisory/OSV/GO-2021-0113
ssvc Track https://deps.dev/advisory/OSV/GO-2021-0113
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://go.dev/cl/340830
generic_textual HIGH https://go.dev/cl/340830
cvssv3.1 7.5 https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
generic_textual HIGH https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
ssvc Track https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
cvssv3.1 5.3 https://groups.google.com/g/golang-announce
cvssv3.1 7.5 https://groups.google.com/g/golang-announce
generic_textual MODERATE https://groups.google.com/g/golang-announce
ssvc Track https://groups.google.com/g/golang-announce
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-38561
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-38561
cvssv3.1 7.5 https://pkg.go.dev/golang.org/x/text/language
generic_textual HIGH https://pkg.go.dev/golang.org/x/text/language
ssvc Track https://pkg.go.dev/golang.org/x/text/language
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2021-0113
generic_textual HIGH https://pkg.go.dev/vuln/GO-2021-0113
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-38561.json
https://api.first.org/data/v1/epss?cve=CVE-2021-38561
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38561
https://deps.dev/advisory/OSV/GO-2021-0113
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://go.dev/cl/340830
https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
https://groups.google.com/g/golang-announce
https://pkg.go.dev/golang.org/x/text/language
https://pkg.go.dev/vuln/GO-2021-0113
2100495 https://bugzilla.redhat.com/show_bug.cgi?id=2100495
cpe:2.3:a:golang:text:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:text:*:*:*:*:*:*:*:*
CVE-2021-38561 https://nvd.nist.gov/vuln/detail/CVE-2021-38561
RHSA-2022:5070 https://access.redhat.com/errata/RHSA-2022:5070
RHSA-2022:5525 https://access.redhat.com/errata/RHSA-2022:5525
RHSA-2022:5556 https://access.redhat.com/errata/RHSA-2022:5556
RHSA-2022:5908 https://access.redhat.com/errata/RHSA-2022:5908
RHSA-2022:5909 https://access.redhat.com/errata/RHSA-2022:5909
RHSA-2022:6051 https://access.redhat.com/errata/RHSA-2022:6051
RHSA-2022:6263 https://access.redhat.com/errata/RHSA-2022:6263
RHSA-2022:6287 https://access.redhat.com/errata/RHSA-2022:6287
RHSA-2022:6318 https://access.redhat.com/errata/RHSA-2022:6318
RHSA-2022:6346 https://access.redhat.com/errata/RHSA-2022:6346
RHSA-2022:6526 https://access.redhat.com/errata/RHSA-2022:6526
RHSA-2022:6537 https://access.redhat.com/errata/RHSA-2022:6537
RHSA-2022:7399 https://access.redhat.com/errata/RHSA-2022:7399
RHSA-2022:7401 https://access.redhat.com/errata/RHSA-2022:7401
RHSA-2022:8750 https://access.redhat.com/errata/RHSA-2022:8750
RHSA-2023:0245 https://access.redhat.com/errata/RHSA-2023:0245
RHSA-2023:0407 https://access.redhat.com/errata/RHSA-2023:0407
RHSA-2023:0408 https://access.redhat.com/errata/RHSA-2023:0408
RHSA-2023:0566 https://access.redhat.com/errata/RHSA-2023:0566
RHSA-2023:0652 https://access.redhat.com/errata/RHSA-2023:0652
RHSA-2023:0774 https://access.redhat.com/errata/RHSA-2023:0774
RHSA-2023:0890 https://access.redhat.com/errata/RHSA-2023:0890
RHSA-2023:0895 https://access.redhat.com/errata/RHSA-2023:0895
RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326
RHSA-2023:1328 https://access.redhat.com/errata/RHSA-2023:1328
RHSA-2023:1409 https://access.redhat.com/errata/RHSA-2023:1409
RHSA-2023:1504 https://access.redhat.com/errata/RHSA-2023:1504
RHSA-2023:3542 https://access.redhat.com/errata/RHSA-2023:3542
RHSA-2023:4310 https://access.redhat.com/errata/RHSA-2023:4310
USN-5873-1 https://usn.ubuntu.com/5873-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-38561.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://deps.dev/advisory/OSV/GO-2021-0113
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-14T16:13:55Z/ Found at https://deps.dev/advisory/OSV/GO-2021-0113
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/cl/340830
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-14T16:13:55Z/ Found at https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://groups.google.com/g/golang-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/g/golang-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-14T16:13:55Z/ Found at https://groups.google.com/g/golang-announce
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-38561
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-38561
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/golang.org/x/text/language
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-14T16:13:55Z/ Found at https://pkg.go.dev/golang.org/x/text/language
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/vuln/GO-2021-0113
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0941
EPSS Score 0.00041
Published At April 10, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.