Description
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | golang-1.15 | 1.15~rc2-1 | — |
| Debian 10 | golang-1.11 | 1.11.6-1+deb10u4 | DSA-4848-1 |
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u2 | DLA-2459-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u2 | DLA-2460-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.1 | USN-5725-1 |
| Ubuntu 20.04 LTS | golang-1.13 | 1.13.8-1ubuntu1.1 | USN-5725-1 |
| Ubuntu 20.04 LTS | golang-1.14 | No fix yet | — |
| Ubuntu 18.04 LTS | golang-1.13 | 1.13.8-1ubuntu1~18.04.4 | USN-5725-1 |
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | golang-1.13 | 1.13.8-1ubuntu1~16.04.3+esm2 | USN-5725-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | delve | 1.3.2-3.module+el8.2.0+5581+896cb53e | RHSA-2020:3665 |
| RHEL 8 | golang +7 | 1.13.15-1.module+el8.2.0+7662+fa98b974 | RHSA-2020:3665 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | ior +10 | 1.1.11-2.el8 | RHSA-2020:5649 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.4.3-19.el8 | RHSA-2020:5649 |
| Red Hat Service Mesh 1 | servicemesh-operator | 1.1.11-3.el8 | RHSA-2020:5649 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.14.0-20.el8 | RHSA-2020:5649 |
| Red Hat Openshift Container Storage 4 | mcg | 5.6.0-39.2279a46.5.6.el8 | RHSA-2020:5606 |
| Red Hat OpenShift 4 | apb +2 | 2.0.3-3.el7 | RHSA-2021:0713 |
| Red Hat OpenShift 4 | atomic-enterprise-service-catalog +1 | 1:4.5.0-202010081312.p0.git.1808.498e523.el7 | RHBA-2020:4229 |
| Red Hat OpenShift 4 | atomic-openshift-service-idler | 4.5.0-202010081312.p0.git.15.d7814b2.el7 | RHBA-2020:4229 |
| Red Hat OpenShift 4 | buildah +1 | 1.11.6-9.rhaos4.5.el8 | RHSA-2021:0713 |
| Red Hat OpenShift 4 | containernetworking-plugins | 0.8.6-2.rhaos4.5.el7 | RHSA-2021:0713 |
| Red Hat OpenShift 4 | cri-o | 1.18.4-4.rhaos4.5.git6dee389.el7 | RHSA-2021:2122, RHSA-2021:0713, RHSA-2020:5119 |
| Red Hat OpenShift 4 | cri-tools | 1.18.0-4.el7 | RHSA-2021:2122, RHSA-2021:0713 |
| Red Hat OpenShift 4 | faq | 0.0.6-5.el7 | RHSA-2020:5159, RHBA-2020:5123 |
| Red Hat OpenShift 4 | ignition +1 | 0.35.1-12.rhaos4.5.gitb4d18ad.el8 | RHSA-2021:1016, RHBA-2020:4197 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1601368321-1.el8 | RHSA-2021:2122, RHSA-2020:4297 |
| Red Hat OpenShift 4 | kubefed-client | 4.5.0-202002271711.git.2.3bd46d6.el7 | RHSA-2021:1016 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.5.0-202012050338.p0.git.2581.e7a62a7.el8 | RHBA-2020:5356 |
| Red Hat OpenShift 4 | openshift +1 | 4.4.0-202011130111.p0.git.0.4861dfa.el7 | RHSA-2021:0713, RHSA-2021:0172, RHBA-2020:5123 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.4.0-202011122017.p0.git.3445.6937a03.el7 | RHSA-2020:4297, RHBA-2020:5123 |
| Red Hat OpenShift 4 | openshift-eventrouter | 0.2-5.git7c289cc.el7 | RHSA-2021:1016, RHSA-2021:0956 |
| Red Hat OpenShift 4 | podman +3 | 1.9.3-2.rhaos4.5.el8 | RHSA-2021:1016, RHSA-2020:4297 |
| Red Hat OpenShift 4 | prometheus-promu +1 | 0.5.0-3.git642a960.el7 | RHSA-2021:1366, RHSA-2021:0713 |
| Red Hat OpenShift 4 | redhat-release-coreos | 47.83-2.el8 | RHSA-2021:2122 |
| Red Hat OpenShift 4 | runc | 1.0.0-81.rhaos4.6.git5b757d4.el7 | RHSA-2020:4297 |
| Red Hat OpenShift 4 | skopeo +2 | 1:1.1.1-2.rhaos4.5.el8 | RHSA-2021:1016, RHSA-2021:0172, RHSA-2020:4297 |
| Red Hat Devtools 2020 | go-toolset-1.13 +2 | 1.13.15-1.el7 | RHSA-2020:4214 |
| Red Hat Devtools 2020 | go-toolset-1.13-golang +6 | 1.13.15-3.el7 | RHSA-2020:4214 |
| Red Hat Container Native Virtualization 4 | kubevirt +2 | 4.9.0-287.el7 | RHSA-2021:4103 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | go1.14 | 1.14.7-1.15.1 | SUSE-SU-2020:2562-1 |
| SLES 15 SP1 | go1.14 | 1.14.7-1.15.1 | SUSE-SU-2020:2562-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.13 | 1.13.15-2.6 | openSUSE-SU-2024:10806-1 |
| openSUSE Tumbleweed | go1.14 | 1.14.15-1.6 | openSUSE-SU-2024:10807-1 |
| openSUSE Leap 15.2 | go1.13 | 1.13.15-lp152.2.7.1 | openSUSE-SU-2020:1194-1 |
| openSUSE Leap 15.2 | go1.14 | 1.14.7-lp152.2.3.1 | openSUSE-SU-2020:1407-1 |
| openSUSE Leap 15.1 | go1.13 | 1.13.15-lp151.8.1 | openSUSE-SU-2020:1178-1 |
| openSUSE Leap 15.1 | go1.14 | 1.14.7-lp151.13.1 | openSUSE-SU-2020:1405-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.15-r0 | — |
| Alpine v3.23 | go | 1.15-r0 | — |
| Alpine v3.22 | go | 1.15-r0 | — |
| Alpine v3.21 | go | 1.15-r0 | — |
| Alpine v3.20 | go | 1.15-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.15-r0 | — |
| Alpine v3.18 | go | 1.15-r0 | — |
| Alpine v3.17 | go | 1.15-r0 | — |
| Alpine v3.16 | go | 1.15-r0 | — |
| Alpine v3.15 | go | 1.15-r0 | — |
| Alpine v3.14 | go | 1.15-r0 | — |
| Alpine v3.13 | go | 1.15-r0 | — |
| Alpine v3.12 | go | 1.13.15-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | golang +6 | 1.13.15-1.amzn2.0.1 | ALAS2-2020-1494 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | delve | 1.3.2-3.0.1.module+el8.2.0+5587+55f012d0 | ELSA-2020-3665 |
| Oracle Linux 8 | golang +7 | 1.13.15-1.module+el8.2.0+7788+3ff8dc7f | ELSA-2020-3665 |
| Oracle Linux 7 | coredns | 1.3.1-1.0.6.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | cri-o +1 | 1.14.7-1.0.8.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | cri-tools | 1.14.0-1.0.6.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | docker-cli +1 | 19.03.11.ol-5.el7 | ELSA-2020-5823 |
| Oracle Linux 7 | etcd | 3.3.10-1.0.5.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | flannel | 0.10.0-2.1.12.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | grafana | 6.7.4-1.0.2.el7 | ELSA-2020-5827 |
| Oracle Linux 7 | helm | 3.1.1-1.0.2.el7 | ELSA-2020-5827 |
| Oracle Linux 7 | istio +10 | 1.4.10-1.0.2.el7 | ELSA-2020-5827 |
| Oracle Linux 7 | kata | 1.7.3-1.0.9.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | kata-agent +1 | 1.7.3-1.0.6.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | kata-image | 1.7.3-1.0.6.1.ol7_202008171204 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | kata-shim +2 | 1.7.3-1.0.5.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | kubeadm +2 | 1.12.10-1.0.15.el7 | ELSA-2020-5828, ELSA-2020-5827, ELSA-2020-5825 |
| Oracle Linux 7 | kubeadm-ha-setup | 0.0.2-1.0.73.el7 | ELSA-2020-5825 |
| Oracle Linux 7 | kubernetes-cni | 0.7.1-1.0.3.el7 | ELSA-2020-5828, ELSA-2020-5827, ELSA-2020-5825 |
| Oracle Linux 7 | kubernetes-cni-plugins | 0.8.6-1.0.3.el7 | ELSA-2020-5828, ELSA-2020-5827, ELSA-2020-5825 |
| Oracle Linux 7 | kubernetes-dashboard | 1.10.1-1.1.8.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.5-2.el7 | ELSA-2020-5827 |
| Oracle Linux 7 | olcnectl +4 | 1.0.7-2.el7 | ELSA-2020-5828, ELSA-2020-5827 |
| Oracle Linux 7 | prometheus | 2.13.1-1.0.3.el7 | ELSA-2020-5827 |
| Oracle Linux 7 | yq | 2.4.0-1.0.5.el7 | ELSA-2020-5828, ELSA-2020-5827 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.13.15 · >= 1.14.0-0, < 1.14.7 | 1.13.15, 1.14.7 | GO-2021-0142 |
Advisories 37
- RHSA-2020:5606 Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.6 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2020:4297 Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2020:4214 Red Hat Security Advisory: go-toolset-1.13-golang security and bug fix update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2020:3665 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:1366 Red Hat Security Advisory: OpenShift Container Platform 4.7.9 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0956 Red Hat Security Advisory: OpenShift Container Platform 4.6.23 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0172 Red Hat Security Advisory: OpenShift Container Platform 4.6.13 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2122 Red Hat Security Advisory: OpenShift Container Platform 4.7.13 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:4103 Red Hat Security Advisory: OpenShift Virtualization 4.9.0 RPMs security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2021:1016 Red Hat Security Advisory: OpenShift Container Platform 4.5.37 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0713 Red Hat Security Advisory: OpenShift Container Platform 4.5.34 packages and security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5649 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.11 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5159 Red Hat Security Advisory: OpenShift Container Platform 4.6.6 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:5119 Red Hat Security Advisory: OpenShift Container Platform 4.5.20 packages and golang security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:5356 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5.23 packages update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:5123 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.31 packages update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:4229 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.5.15 packages update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:4197 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6 GA RPMs Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-5725-2 golang-1.13 vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5725-1 golang-1.13 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4848-1 golang-1.11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2459-1 golang-1.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2460-1 golang-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10806-1 go1.13-1.13.15-2.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2562-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1405-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1194-1 Security update for go1.13 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10807-1 go1.14-1.14.15-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1407-1 Security update for go1.14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1178-1 Security update for go1.13 SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-1599 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- ALAS2-2020-1494 Moderate: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 30, 2020
- ELSA-2020-3665 Moderate: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 11, 2020
- ELSA-2020-5827 Important: olcne conmon coredns cri-o cri-tools etcd flannel grafana helm istio kata kata-agent kata-image kata-ksm-throttler kata-proxy kata-runtime kata-shim kubernetes kubernetes-cni kubernetes-cni-plugins kubernetes-dashboard prometheus yq security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 31, 2020
- ELSA-2020-5828 Important: coredns cri-o cri-tools etcd flannel kata kata-agent kata-image kata-ksm-throttler kata-proxy kata-runtime kata-shim kubernetes kubernetes-cni kubernetes-cni-plugins kubernetes-dashboard olcne yq security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 31, 2020
- ELSA-2020-5823 Important: docker-cli docker-engine security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 24, 2020
- ELSA-2020-5825 Important: kubernetes kubeadm-ha-setup kubernetes-cni kubernetes-cni-plugins security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 24, 2020
References
- https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q
- openSUSE-SU-2020:1178 vendor-advisory
- openSUSE-SU-2020:1194 vendor-advisory
- FEDORA-2020-e384830a0d vendor-advisory
- FEDORA-2020-deff052e7a vendor-advisory
- FEDORA-2020-a55f130272 vendor-advisory
- FEDORA-2020-b190375a37 vendor-advisory
- openSUSE-SU-2020:1405 vendor-advisory
- openSUSE-SU-2020:1407 vendor-advisory
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2459-1] golang-1.7 security update mailing-list
- [debian-lts-announce] 20201121 [SECURITY] [DLA 2460-1] golang-1.8 security update mailing-list
- DSA-4848 vendor-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo
- https://security.netapp.com/advisory/ntap-20200924-0002/