{"action":"Upgrade golang-1.15 to 1.15.15-1~deb11u1 or later.","affected":[{"fixed":"1.15.15-1~deb11u1","introduced":"0"}],"component":"golang-1.15","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:11","exploited":false,"fixed_versions":["1.15.15-1~deb11u1"],"id":"tcs_01M5NFY0YCES12M3VZX2GVZQXJ","modified_at":"2026-08-27T23:04:09.214078662Z","published_at":"2022-01-24T01:15:07.920Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-39293","https://security-tracker.debian.org/tracker/CVE-2021-39293"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-39293","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-39293"}],"summary":"In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exis"}