CVE-2021-27918: Infinite loop when decoding inputs in encoding/xml
Summary
CVE-2021-27918: Infinite loop when decoding inputs in encoding/xml. Affects stdlib across 2 version ranges.
< 1.15.9
>= 1.16.0-0, < 1.16.1
Fixed in 1.15.9 or 1.16.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-27918 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. The encoding/xml package within stdlib allows for encoding and decoding XML data. It includes the xml.Decoder type, which provides methods like Decode, DecodeElement, and Skip for parsing XML input. These methods are used to read and process XML data in a structured manner.
Vulnerability Detail
The vulnerability identified as CVE-2021-27918 affects the xml.Decoder provided by xml.NewTokenDecoder in the encoding/xml package. When operating on a custom xml.TokenReader, if the reader returns an EOF (end-of-file) in the middle of an open XML element, the Decode, DecodeElement, and Skip methods may enter an infinite loop. This can lead to resource exhaustion and denial-of-service (DoS) attacks. The vulnerability was discovered by Sam Whited.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.15.91.15.9go get stdlib@v1.15.9 -
>= 1.16.0-0, < 1.16.11.16.1go get stdlib@v1.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the Go stdlib package to the fixed versions.
Conclusion
In summary, the CVE-2021-27918 vulnerability affects the xml.Decoder in the Go stdlib package. It can result in an infinite loop when decoding inputs, leading to resource exhaustion and potential denial-of-service attacks. To mitigate this vulnerability, it is crucial to update the affected package to version 1.15.9 or later, or version 1.16.1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can lead to an infinite loop, causing resource exhaustion and potential denial-of-service (DoS) attacks. It is important to update the affected package to prevent these issues.
Versions prior to 1.15.9 and 1.16.1 are affected by this vulnerability. It is recommended to update to the fixed versions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file to the playground, and it will alert you in real-time if the vulnerability is present.
There are no known exploits for this vulnerability at the moment. However, it is crucial to update the affected package to mitigate the risk of potential attacks.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2021-0234.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
