CVE-2021-33197: Golang Go

Medium severity, CVSS 5.3. EPSS: 2.3% chance of exploitation in the next 30 days.

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

Affected products

• Golang Go: before 1.15.13 (fixed in 1.15.13); from 1.16.0, before 1.16.5 (fixed in 1.16.5)

Published 2021-08-02. Last modified 2026-06-17.