GO-2021-0224

Source
https://pkg.go.dev/vuln/GO-2021-0224
Import Source
https://vuln.go.dev/ID/GO-2021-0224.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2021-0224
Aliases
Published
2022-02-17T17:36:04Z
Modified
2024-05-20T16:03:47Z
Summary
Data race and crash in net/http
Details

HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected.

References
Credits
    • Mikael Manukyan
    • Andrew Kutz
    • Dave McClure
    • Tim Downey
    • Clay Kauzlaric
    • Gabe Rosenhouse

Affected packages

Go / stdlib

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.13.13
Introduced
1.14.0-0
Fixed
1.14.5

Ecosystem specific

{
    "imports": [
        {
            "path": "net/http",
            "symbols": [
                "expectContinueReader.Read"
            ]
        }
    ]
}