CVE-2021-31525

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or…

published May 27, 2021

CVSS
—
EPSS
4%
Percentile
89.7
In the wild
Unconfirmed
What it is

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03692 · 89.7th percentile
Published
2021-05-27T12:17Z
EPSS history
Timeline
  • 27 MAY 12:17Z
    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or…
    cvelistv5