CVE-2021-31525

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

• CWE-674

• https://github.com/golang/go/issues/45710Issue Tracking, Patch, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/cu9SP4eSXMcMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://github.com/golang/go/issues/45710Issue Tracking, Patch, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/cu9SP4eSXMcMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/
• https://security.gentoo.org/glsa/202208-02Third Party Advisory

Published

May 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31519An incorrect permission vulnerability in the product install…7.3
• CVE-2021-3152Home Assistant before 2021.1.3 does not have a protection la…5.3
• CVE-2021-31520A weak session token authentication bypass vulnerability in …8.1
• CVE-2021-31521Trend Micro InterScan Web Security Virtual Appliance version…5.4
• CVE-2021-31522Kylin can receive user input and load any class through Clas…9.8
• CVE-2021-31523The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSave…7.8
• CVE-2021-3153HashiCorp Terraform Enterprise up to v202102-2 failed to enf…6.5
• CVE-2021-31530Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulne…7.5
• CVE-2021-31531Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulne…9.8
• CVE-2021-31532NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silic…6.8
• CVE-2021-31535LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7…9.8
• CVE-2021-31537SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/in…6.1