VDB
RHEA-2021%3A2679
RHEA-2021%3A2679
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A vulnerability was detected in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however, servers are only vulnerable if the value of MaxHeaderBytes has been increased from the default.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | advanced-cluster-security/rhacs-operator-bundle@sha256:6cdcf20771f9c46640b466f804190d00eaf2e59caee6d420436e78b283d177bf_amd64 as a component of RHACS 3.62 for RHEL 8 | advanced-cluster-security/rhacs-operator-bundle@sha256:6cdcf20771f9c46640b466f804190d00eaf2e59caee6d420436e78b283d177bf_amd64 |
| Red Hat | advanced-cluster-security/rhacs-rhel8-operator@sha256:b7dfdfd977c1bbb0dbb1c7e5a0d2c023e1bd9d28859c2faa4598f8815b86d188_amd64 as a component of RHACS 3.62 for RHEL 8 | advanced-cluster-security/rhacs-rhel8-operator@sha256:b7dfdfd977c1bbb0dbb1c7e5a0d2c023e1bd9d28859c2faa4598f8815b86d188_amd64 |
Timeline
- Jul 8, 2021 CVE Published
- Mar 19, 2026 CVE Updated
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHEA-2021:2679 advisory
- http://docs.openshift.com/acs/welcome/ advisory
- https://issues.redhat.com/browse/ROX-9384 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhea-2021_2679.json advisory
- https://access.redhat.com/security/cve/CVE-2021-31525 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1958341 issue
- https://www.cve.org/CVERecord?id=CVE-2021-31525 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-31525 advisory
- https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc advisory