Go/golang.org/x/net CVE-2021-31525: unknown, EPSS 3.69%

Panic due to large headers in net/http and golang.org/x/net/http/httpguts

Action: Upgrade golang.org/x/net to 0.0.0-20210428140749-89ef3d95e781 or later.

go get golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781

Affected

Fixed versions

Sources

• osv: GO-2022-0236#Go/golang.org/x/net
• https://go.dev/cl/313069
• https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9
• https://go.dev/issue/45710
• https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc

CVE-2021-31525 · published 2022-07-15T23:04:18Z · modified 2026-02-04T02:54:01.110291Z · JSON