CVE-2021-31525: Fedoraproject Fedora

Medium severity, CVSS 5.9. EPSS: 3.7% chance of exploitation in the next 30 days.

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Affected products

• Fedoraproject Fedora: version 34 only
• Golang Go: before 1.15.12 (fixed in 1.15.12); from 1.16.0, before 1.16.4 (fixed in 1.16.4)

Published 2021-05-27. Last modified 2026-06-17.