Description
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | golang-1.15 | 1.15.9-5 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | golang-1.16 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | golang-1.16 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | buildah +1 | 1:1.27.0-2.el9 | RHSA-2022:8008 |
| RHEL 9 | podman +5 | 2:4.2.0-3.el9 | RHSA-2022:7954 |
| RHEL 8 | delve | 1.6.0-1.module+el8.5.0+10379+d6b83bd0 | RHSA-2021:4156 |
| RHEL 8 | golang +7 | 1.16.7-1.module+el8.5.0+12246+1aac4e3f | RHSA-2021:4156 |
| RHEL 8 | grafana | 7.5.9-4.el8 | RHSA-2021:4226 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Serverless 1 | openshift-serverless-clients | 0.23.2-1.el8 | RHSA-2021:3555 |
| Red Hat Openshift Data Foundation 4 | mcg | 5.9.0-28.61dcf87.5.9.el8 | RHSA-2021:5085 |
| Red Hat OpenStack 16 | etcd | 3.3.23-3.1.el8ost.1 | RHSA-2021:5072, RHSA-2021:3487 |
| Red Hat OpenShift 4 | atomic-openshift-service-idler | 4.7.0-202107291238.p0.git.39cfc66.assembly.stream.el8 | RHBA-2021:2979 |
| Red Hat OpenShift 4 | butane | 0.12.1-2.rhaos4.8.el8 | RHSA-2021:3820 |
| Red Hat OpenShift 4 | containernetworking-plugins | 0.8.6-3.rhaos4.6.el7 | RHSA-2021:3248 |
| Red Hat OpenShift 4 | cri-o | 1.20.4-7.rhaos4.7.git6287500.el7 | RHSA-2021:2984, RHBA-2021:2979 |
| Red Hat OpenShift 4 | cri-tools | 1.21.0-3.el8 | RHSA-2021:3248 |
| Red Hat OpenShift 4 | ignition +1 | 2.6.0-8.rhaos4.6.git947598e.el8 | RHSA-2021:3009, RHSA-2021:2984, RHBA-2021:2979 |
| Red Hat OpenShift 4 | jenkins | 2.289.3.1633554819-1.el8 | RHSA-2021:3820 |
| Red Hat OpenShift 4 | openshift +1 | 4.7.0-202107292242.p0.git.558d959.assembly.stream.el7 | RHSA-2021:2984, RHBA-2021:2979 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.7.0-202107292242.p0.git.8b4b094.assembly.stream.el7 | RHSA-2021:2984, RHBA-2021:2979 |
| Red Hat OpenShift 4 | prometheus-promu +1 | 0.5.0-4.git642a960.el8 | RHSA-2021:3248 |
| Red Hat OpenShift 4 | redhat-release-coreos | 47.84-1.el8 | RHBA-2021:2979 |
| Red Hat Devtools 2021 | go-toolset-1.15-golang +6 | 1.15.14-2.el7_9 | RHSA-2021:3431 |
| Red Hat Container Native Virtualization 4 | kubevirt +2 | 4.8.5-278.el7 | RHSA-2022:1329 |
| Red Hat Container Native Virtualization 2 | kubevirt +2 | 2.6.10-230.el7 | RHSA-2022:1402 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | buildah +1 | 1:1.27.0-2.el9 | ALSA-2022:8008 |
| AlmaLinux 9 | podman +5 | 2:4.2.0-3.el9 | ALSA-2022:7954 |
| AlmaLinux 8 | delve | 1.6.0-1.module_el8.5.0+2604+960c7771 | ALSA-2021:4156 |
| AlmaLinux 8 | grafana | 7.5.9-4.el8 | ALSA-2021:4226 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | delve | 1.6.0-1.module+el8.5.0+694+f77f0bfd | RLSA-2021:4156 |
| Rocky Linux 8 | golang +1 | 1.16.7-1.module+el8.5.0+694+f77f0bfd | RLSA-2021:4156 |
| Rocky Linux 8 | grafana | 7.5.9-4.el8 | RLSA-2021:4226 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SLES 15 SP3 | go1.16 | 1.16.5-1.17.1 | SUSE-SU-2021:2186-1 |
| SLES 15 SP2 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SLES 15 SP2 | go1.16 | 1.16.5-1.17.1 | SUSE-SU-2021:2186-1 |
| SLES 15 SP1 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SLE HPC 15 SP1 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SUSE Manager Server 4.0 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SUSE Manager Retail Branch Server 4.0 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SUSE Manager Proxy 4.0 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
| SUSE Enterprise Storage 6 | go1.15 | 1.15.13-1.33.1 | SUSE-SU-2021:2214-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.15 | 1.15.15-1.2 | openSUSE-SU-2024:10808-1 |
| openSUSE Tumbleweed | go1.16 | 1.16.8-1.1 | openSUSE-SU-2024:10809-1 |
| openSUSE Leap 15.3 | go1.15 | 1.15.13-1.33.1 | openSUSE-SU-2021:2214-1 |
| openSUSE Leap 15.3 | go1.16 | 1.16.5-1.17.1 | openSUSE-SU-2021:2186-1 |
| openSUSE Leap 15.2 | go1.15 | 1.15.13-lp152.20.1 | openSUSE-SU-2021:0950-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.16.5-r0 | — |
| Alpine v3.23 | go | 1.16.5-r0 | — |
| Alpine v3.22 | go | 1.16.5-r0 | — |
| Alpine v3.21 | go | 1.16.5-r0 | — |
| Alpine v3.20 | go | 1.16.5-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.16.5-r0 | — |
| Alpine v3.18 | go | 1.16.5-r0 | — |
| Alpine v3.17 | go | 1.16.5-r0 | — |
| Alpine v3.16 | go | 1.16.5-r0 | — |
| Alpine v3.15 | go | 1.16.5-r0 | — |
| Alpine v3.14 | go | 1.16.5-r0 | — |
| Alpine v3.13 | go | 1.15.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | golang +7 | 1.16.15-1.amzn2.0.1 | ALAS2-2022-1776 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | buildah +1 | 1:1.27.0-2.0.1.el9 | ELSA-2022-8008 |
| Oracle Linux 9 | podman +6 | 2:4.2.0-3.0.1.el9 | ELSA-2022-7954 |
| Oracle Linux 8 | grafana | 7.5.9-4.el8 | ELSA-2021-4226 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.15.13 · >= 1.16.0-0, < 1.16.5 | 1.15.13, 1.16.5 | GO-2021-0241 |
Advisories 36
- ALSA-2022:8008 Moderate: buildah security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:7954 Moderate: podman security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2021:4226 Moderate: grafana security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2021:4156 Moderate: go-toolset:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7954 Red Hat Security Advisory: podman security and bug fix update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2022:8008 Red Hat Security Advisory: buildah security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2021:4226 Red Hat Security Advisory: grafana security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2022:1402 Red Hat Security Advisory: OpenShift Virtualization 2.6.10 RPMs security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2022:1329 Red Hat Security Advisory: OpenShift Virtualization 4.8.5 RPMs security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:5085 Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:5072 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:4156 Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:3820 Red Hat Security Advisory: OpenShift Container Platform 4.8.15 packages and security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:3555 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.17.0 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:3487 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:3431 Red Hat Security Advisory: go-toolset-1.15-golang security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:3248 Red Hat Security Advisory: OpenShift Container Platform 4.8.9 packages and security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:3009 Red Hat Security Advisory: OpenShift Container Platform 4.6.42 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:2984 Red Hat Security Advisory: OpenShift Container Platform 4.8.4 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHBA-2021:2979 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.7.23 packages update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RLSA-2021:4226 Moderate: grafana security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2021:4156 Moderate: go-toolset:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2021:2186-1 Security update for go1.16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10809-1 go1.16-1.16.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2214-1 Security update for go1.15 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10808-1 go1.15-1.15.15-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2214-1 Security update for go1.15 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2186-1 Security update for go1.16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0950-1 Security update for go1.15 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- ALAS2-2022-1776 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 7, 2025
- WID-SEC-2022-0941 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 18, 2024
- ELSA-2022-8008 Moderate: buildah security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022
- ELSA-2022-7954 Moderate: podman security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022
- ELSA-2021-4226 Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 16, 2021