golang: data race in certain net/http servers including ReverseProxy can lead to DoS

🗓️ 17 Dec 2020 05:43:57Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

A data race in Go's net/http standard library ReverseProxy can cause denial of service.

Reporter	Title	Published	Views	Family All 191
IBM Security Bulletins	Security Bulletin: GO security vulnerabilities on IBM Watson Machine Learning Server	3 May 202115:00	–	ibm
IBM Security Bulletins	Security Bulletin: Upgrade to IBP v2.5.1 to address recent concerns/issues with Golang versions other than 1.14.7	4 Dec 202016:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	29 Aug 202008:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	25 Aug 202202:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2020-15586)	26 Feb 202114:02	–	ibm
IBM Security Bulletins	Security Bulletin: Go is vulnerable to a denial of service on IBM Watson Machine Learning on CP4D	3 May 202115:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Integration Operators affected by multiple vulnerabilities	2 Oct 202013:03	–	ibm
IBM Security Bulletins	Security Bulletin: Golang Vulnerabilities in IBM Cloud CLI 1.1.0 or earlier	20 Aug 202019:29	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC.	4 Feb 202121:36	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Service.	14 Dec 202018:29	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	ppc64le	mcg	5.6.0-39.2279a46.5.6.el8	mcg-5.6.0-39.2279a46.5.6.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	mcg	5.6.0-39.2279a46.5.6.el8	mcg-5.6.0-39.2279a46.5.6.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	mcg	5.6.0-39.2279a46.5.6.el8	mcg-5.6.0-39.2279a46.5.6.el8.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-15586
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
groups	www.groups.google.com/g/golang-announce/c/XZNfaiwgt2w/m/E6gHDs32AQAJ
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-15586
cve	www.cve.org/CVERecord

03 Jul 2026 17:25Current

7.3High risk

Vulners AI Score7.3

CVSS 24.3

CVSS 3.15.9

EPSS0.02893

Go language data race reverse proxy denial of service standard library web server unix