golang: net/http/httputil: panic due to racy read of persistConn after handler panic

🗓️ 13 Apr 2022 15:33:28Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Golang net/http/httputil panic from race after handler panic leaves body open, risking crash.

Reporter	Title	Published	Views	Family All 175
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to multiple Go vulnerabilities	14 Oct 202113:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	25 Aug 202202:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	7 Apr 202219:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-36221)	22 Apr 202218:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PostgreSQL, Apache, Golang Go, and Linux Kernel affect IBM Spectrum Copy Data Management	10 Dec 202123:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Go vulnerabilities	15 Oct 202113:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams affected by multiple vulnerabilities in Golang	21 Dec 202117:45	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Golang Go affects IBM Cloud Pak for Multicloud Management Managed Services	9 Nov 202118:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	ppc64le	mcg	5.10.0-72.el8	mcg-5.10.0-72.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	mcg	5.10.0-72.el8	mcg-5.10.0-72.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	mcg	5.10.0-72.el8	mcg-5.10.0-72.el8.x86_64.rpm
Red Hat Enterprise Linux	8	x86_64	mcg-redistributable	5.10.0-72.el8	mcg-redistributable-5.10.0-72.el8.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-36221
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
groups	www.groups.google.com/g/golang-announce/c/uHACNfXAZqk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-36221
cve	www.cve.org/CVERecord

18 Jul 2026 23:46Current

7.1High risk

Vulners AI Score7.1

CVSS 24.3

CVSS 3.15.9

EPSS0.03128

go language reverse proxy race condition handler panic request body