CVE-2021-33194 — Infinite Loop in X NET

CWE-835 — Infinite Loop11 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 61.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Golang.org X NETGolang GOFedoraproject Fedora
Timeline
PublishedMay 26
Latest updateApr 7

Description

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Gogolang.org/x_net< 0.0.0-20210520170846-37e1c6afe023
▶NVDgolang/go1.16.0 — 1.16.4+1

Also affects: Fedora 36

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
golang.org/x/net/html Infinite Loop vulnerability↗2022-05-24
▶
OSV
golang.org/x/net/html Infinite Loop vulnerability↗2022-05-24
▶
OSV
Infinite loop when parsing inputs in golang.org/x/net/html↗2022-02-17
▶
OSV
CVE-2021-33194: golang↗2021-05-26
▶
CVEList
CVE-2021-33194: golang↗2021-05-26
▶

📋Vendor Advisories

5
Ubuntu
ADSys, Juju Core, LXD vulnerabilities↗2026-04-07
▶
Ubuntu
Go Networking vulnerabilities↗2026-03-31
▶
Red Hat
golang: x/net/html: infinite loop in ParseFragment↗2021-05-20
▶
Microsoft
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.↗2021-05-11
▶
Debian
CVE-2021-33194: golang-golang-x-net - golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to c...↗2021
▶
CVE-2021-33194 — Infinite Loop in Golang.org X NET | cvebase