CVE-2021-33195: Golang Go

High severity, CVSS 7.3. EPSS: 3.2% chance of exploitation in the next 30 days.

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

Affected products

• Golang Go: before 1.15.13 (fixed in 1.15.13); from 1.16.0, before 1.16.5 (fixed in 1.16.5)
• Netapp Cloud Insights Telegraf Agent: affected versions not specified

Published 2021-08-02. Last modified 2026-06-17.