CVE-2021-33195: Improper sanitization when resolving values from DNS in net
Summary
CVE-2021-33195: Improper sanitization when resolving values from DNS in net. Affects stdlib across 2 version ranges.
< 1.15.13
>= 1.16.0-0, < 1.16.5
Fixed in 1.15.13 or 1.16.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-33195 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem provides a set of standard libraries for the Go programming language. One of the packages in stdlib is 'net', which offers functionality for network operations. The 'net' package includes the Resolver type and several associated methods like LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr. These methods are used to retrieve information from DNS (Domain Name System) servers. However, prior to version 1.15.13 and 1.16.5, the returned values from these methods were not properly sanitized according to the RFC 1035 rules for domain names.
Vulnerability Detail
The vulnerability (CVE-2021-33195) arises due to the improper sanitization of DNS values in the 'net' package. When using the LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions or their respective methods on the Resolver type, arbitrary values retrieved from DNS may be returned. These values may not conform to the established RFC 1035 rules for domain names. If these names are used without further sanitization, such as being included in HTML unsafely, it could lead to the injection of unexpected content. It is important to note that the LookupTXT method may also return arbitrary values that require sanitization before further use.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.15.131.15.13go get stdlib@v1.15.13 -
>= 1.16.0-0, < 1.16.51.16.5go get stdlib@v1.16.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by manually sanitizing the returned DNS values before further use. This can be done by applying appropriate sanitization techniques, such as validating the domain names against the RFC 1035 rules and ensuring they are safe for inclusion in HTML or other contexts.
Conclusion
The vulnerability (CVE-2021-33195) in the 'net' package's DNS resolution functions can lead to the injection of unexpected content if unsanitized values are used. To mitigate this vulnerability, it is crucial to update the affected package to version 1.15.13 or later for Go 1.15.x, and version 1.16.5 or later for Go 1.16.x. Alternatively, manual sanitization of DNS values can be performed as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows for the injection of unexpected content when unsanitized DNS values are used. This could potentially lead to various security issues, such as cross-site scripting (XSS) attacks or the display of malicious content.
Versions prior to 1.15.13 for Go 1.15.x and versions prior to 1.16.5 for Go 1.16.x are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly address and fix the vulnerability to mitigate potential risks.
Yes, patches addressing this vulnerability are available in versions 1.15.13 and later for Go 1.15.x, and versions 1.16.5 and later for Go 1.16.x. It is recommended to update to these patched versions to ensure the proper sanitization of DNS values.
While updating the package is the recommended approach, a temporary workaround can be implemented by manually sanitizing the returned DNS values before use. This involves validating the domain names against the RFC 1035 rules and ensuring their safe inclusion in relevant contexts.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
