CVE-2021-38297: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 10.9% chance of exploitation in the next 30 days.

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Affected products

• Fedoraproject Fedora: version 34 only; version 35 only
• Golang Go: before 1.16.9 (fixed in 1.16.9); from 1.17.0, before 1.17.2 (fixed in 1.17.2)

Published 2021-10-18. Last modified 2026-06-17.