CVE-2021-36221: Debian Linux

Medium severity, CVSS 5.9. EPSS: 3.1% chance of exploitation in the next 30 days.

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Golang Go: before 1.15.15 (fixed in 1.15.15); from 1.16.0, before 1.16.7 (fixed in 1.16.7)
• Oracle Timesten In-Memory Database: before 21.1.1.1.0 (fixed in 21.1.1.1.0)
• Siemens Scalance LPE9403 Firmware: before 2.0 (fixed in 2.0)

Published 2021-08-08. Last modified 2026-06-17.