CVE-2021-44717: Misdirected I/O in syscall in Go stdlib
Summary
CVE-2021-44717: Misdirected I/O in syscall. Affects stdlib across 2 version ranges.
< 1.16.12
>= 1.17.0-0, < 1.17.5
Fixed in 1.16.12 or 1.17.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-44717 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go stdlib package is a collection of standard libraries that provide essential functionality for Go programs. It includes various modules for file operations, networking, and system calls. This vulnerability affects the syscall module in the stdlib package, which is responsible for low-level operating system interactions. The vulnerability allows for misdirected I/O, where network traffic or file content intended for one connection or file can be mistakenly redirected to another.
Vulnerability Detail
The vulnerability arises when a Go program running on a Unix system exhausts its file descriptors and invokes the syscall.ForkExec function. In such cases, syscall.ForkExec may close file descriptor 0, leading to misdirected I/O. This can result in network traffic meant for one connection being sent to a different connection, or content intended for one file being written to a different file. The impact of this vulnerability can be severe, potentially leading to data corruption, unauthorized access, or information leakage.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.16.121.16.12go get stdlib@v1.16.12 -
>= 1.17.0-0, < 1.17.51.17.5go get stdlib@v1.17.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate package updates are not feasible, a temporary workaround is to raise the per-process file descriptor limit. This can help mitigate the risk of encountering the misdirected I/O issue. The file descriptor limit can be increased by modifying the system configuration or using system calls specific to the operating system. Consult the operating system documentation or seek assistance from a system administrator for guidance on adjusting the file descriptor limit.
Conclusion
The vulnerability in the Go stdlib package's syscall module can lead to misdirected I/O, potentially causing data corruption or unauthorized access. It is crucial to update the package to the recommended versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can lead to misdirected I/O, causing network traffic or file content to be sent or written to unintended destinations. This can result in data corruption, unauthorized access, or information leakage.
Versions prior to 1.16.12 and 1.17.5 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities, including this one.
Yes, updating the Go stdlib package to version 1.16.12 or later, or version 1.17.5 or later, will address this vulnerability.
If immediate package updates are not possible, you can mitigate the risk by raising the per-process file descriptor limit. Consult the operating system documentation or seek assistance from a system administrator for guidance on adjusting the file descriptor limit.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
