CVE-2021-27919: Panic when opening archives in archive/zip
Summary
CVE-2021-27919: Panic when opening archives in archive/zip. Affects stdlib versions >= 1.16.0-0, < 1.16.1. Fixed in 1.16.1. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2021-27919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'archive/zip' package is a part of the Go standard library and provides functionality for creating, reading, and writing ZIP archives. It is commonly used in Go applications to handle compressed files. However, a vulnerability has been discovered in the package that can lead to a panic and denial of service when opening archives containing files with paths prefixed by '../'. This vulnerability affects versions 1.16.0-0 to 1.16.1 of the Go standard library.
Vulnerability Detail
When using the 'Reader.Open' function on an archive that includes a file with a path prefixed by '../', a stack overflow occurs, resulting in a panic. This vulnerability can be exploited by an attacker to cause a denial of service by providing a specially crafted archive. The issue arises due to improper handling of user-supplied archives and can lead to the application crashing or becoming unresponsive.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16.1
This is the first release that contains the fix.
go get stdlib@v1.16.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the affected package to the fixed version.
Conclusion
The 'archive/zip' package in the Go standard library is vulnerable to a stack overflow issue when opening archives with files containing paths prefixed by '../'. This can be exploited as a denial of service vector. To mitigate this vulnerability, it is crucial to update the affected package to version 1.16.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can be used as a denial of service vector, causing the affected application to crash or become unresponsive.
Versions 1.16.0-0 to 1.16.1 of the Go standard library are affected by this vulnerability.
No, this vulnerability requires the attacker to provide a specially crafted archive to exploit it.
Updating the Go standard library to version 1.16.1 or later is the recommended mitigation for this vulnerability.
Yes, the fix for this vulnerability is included in version 1.16.1 of the Go standard library.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
