VDB
RHSA-2021%3A3733
RHSA-2021%3A3733
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A vulnerability was detected in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however, servers are only vulnerable if the value of MaxHeaderBytes has been increased from the default.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:59070d43607b341ecaa9a65f999fed06ef03885035fa3deef0f2f3a7b9287d13_amd64 as a component of CNV 2.6 for RHEL 8 | container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:59070d43607b341ecaa9a65f999fed06ef03885035fa3deef0f2f3a7b9287d13_amd64 |
| Red Hat | container-native-virtualization/vm-import-controller-rhel8@sha256:b0cdc6f7ce1e48a77fa1e1b683e386828dd9973872a03ac9f2a7c21efa0eef40_amd64 as a component of CNV 2.6 for RHEL 8 | container-native-virtualization/vm-import-controller-rhel8@sha256:b0cdc6f7ce1e48a77fa1e1b683e386828dd9973872a03ac9f2a7c21efa0eef40_amd64 |
| Red Hat | container-native-virtualization/vm-import-controller@sha256:b0cdc6f7ce1e48a77fa1e1b683e386828dd9973872a03ac9f2a7c21efa0eef40_amd64 as a component of CNV 2.6 for RHEL 8 | container-native-virtualization/vm-import-controller@sha256:b0cdc6f7ce1e48a77fa1e1b683e386828dd9973872a03ac9f2a7c21efa0eef40_amd64 |
| Red Hat | container-native-virtualization/kubevirt-cpu-node-labeller@sha256:11940ade61478e72b11faa3806967583c00779718206953e606025dd8a094c57_amd64 as a component of CNV 2.6 for RHEL 8 | container-native-virtualization/kubevirt-cpu-node-labeller@sha256:11940ade61478e72b11faa3806967583c00779718206953e606025dd8a094c57_amd64 |
| Red Hat | container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:6a4d596992e1b1a028756ed9d8c4b3acc6ef61bd510a890ab61d8ab35cbe3331_amd64 as a component of CNV 2.6 for RHEL 8 | container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:6a4d596992e1b1a028756ed9d8c4b3acc6ef61bd510a890ab61d8ab35cbe3331_amd64 |
Timeline
- Oct 6, 2021 CVE Published
- Mar 27, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:3733 advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1958341 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1983596 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1987262 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1990560 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1991906 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1995132 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3733.json advisory
- https://access.redhat.com/security/cve/CVE-2021-31525 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-31525 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-31525 advisory
- https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc advisory
- https://access.redhat.com/security/cve/CVE-2021-34558 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-34558 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-34558 advisory
- https://golang.org/doc/devel/release#go1.15.minor advisory
- https://golang.org/doc/devel/release#go1.16.minor advisory