CVE-2021-39293: Panic due to crafted inputs in archive/zip
Summary
CVE-2021-39293: Panic due to crafted inputs in archive/zip. Affects stdlib across 2 version ranges.
< 1.16.8
>= 1.17.0-0, < 1.17.1
Fixed in 1.16.8 or 1.17.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-39293 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides a collection of standard libraries for various functionalities. One of these libraries is archive/zip, which allows for the creation and extraction of ZIP archives. It includes functions like NewReader and OpenReader, which are used to read ZIP archives. However, a vulnerability has been discovered in these functions that can lead to a panic or an unrecoverable fatal error when processing a specially crafted ZIP archive. This vulnerability was introduced in versions 0 and 1.17.0-0 of the stdlib package and was partially fixed in versions 1.16.8 and 1.17.1.
Vulnerability Detail
The vulnerability in archive/zip arises from an incomplete fix for CVE-2021-33196. When reading a ZIP archive that claims to contain a large number of files, regardless of its actual size, the NewReader and OpenReader functions can trigger a panic or an unrecoverable fatal error. This can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code. The issue stems from improper handling of the number of files in the ZIP archive, leading to a panic when the number exceeds certain limits.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.16.81.16.8go get stdlib@v1.16.8 -
>= 1.17.0-0, < 1.17.11.17.1go get stdlib@v1.17.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to update the stdlib package to the fixed versions.
Conclusion
The vulnerability in archive/zip can lead to a panic or an unrecoverable fatal error when processing a specially crafted ZIP archive. It is crucial to update the stdlib package to versions 1.16.8 or 1.17.1 to mitigate this vulnerability. Regularly updating dependencies is also recommended to stay up-to-date with security patches and bug fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
archive/zip is a standard library package in Go that provides functionality for creating and extracting ZIP archives.
The NewReader and OpenReader functions in the archive/zip package are affected by this vulnerability.
Exploiting this vulnerability can lead to a panic or an unrecoverable fatal error, potentially causing a denial-of-service condition or enabling arbitrary code execution.
Versions 0 and 1.17.0-0 of the stdlib package are affected by this vulnerability.
No specific workarounds are provided. Updating to the fixed versions of the stdlib package is recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
