{"id":"CVE-2021-33194","published":"2021-05-26T14:49:46Z","modified":"2024-08-03T23:42:20Z","title":"golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite…","vendor":null,"product":null,"tier":"tail","description":{"text":"golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07492,"percentile":0.94467,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/g/golang-announce/c/wPunbCPkWUg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":18.89}]},"affected":[{"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.0.0-20210520170846-37e1c6afe023"],"patched":["0.0.0-20210520170846-37e1c6afe023"],"from":["GHSA-83g2-8m93-v3w7","GO-2021-0238"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3094","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-golang-org-x-net-cve-2018-17075","parents":[{"from":"CVE-2018-17075","to":"CVE-2021-33194","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["html/parse.go"],"commits":["https://github.com/golang/net/commit/aaf60122140d3fcf75376d319f0554393160eb50","https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2019-9512","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false},{"cve":"CVE-2019-9514","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false},{"cve":"CVE-2021-31525","published":"2021-05-27","fixed":"0.0.0-20210428140749-89ef3d95e781","kev":false,"link":{"from":"CVE-2021-31525","to":"CVE-2021-33194","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20210428140749-89ef3d95e781","toFixed":"0.0.0-20210520170846-37e1c6afe023","daysApart":-1}]}},{"cve":"CVE-2021-33194","published":"2021-05-26","fixed":"0.0.0-20210520170846-37e1c6afe023","kev":false},{"cve":"CVE-2021-44716","published":"2022-01-01","fixed":"0.0.0-20211209124913-491a49abca63","kev":false,"link":{"from":"CVE-2021-33194","to":"CVE-2021-44716","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20210520170846-37e1c6afe023","toFixed":"0.0.0-20211209124913-491a49abca63","daysApart":220}]}},{"cve":"CVE-2022-27664","published":"2022-09-06","fixed":"0.0.0-20220906165146-f3363e06e74c","kev":false},{"cve":"CVE-2022-41721","published":"2023-01-13","fixed":"0.1.1-0.20221104162952-702349b0e862","kev":false}],"package":"Go:golang.org/x/net"}}