CVE-2021-33198: Panic on inputs with large exponents in math/big

stdlib Updated 02 Oct 2025

Summary

17/02/2022

Disclosed on

CVE-2021-33198

CVE

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2021-33198: Panic on inputs with large exponents in math/big. Affects stdlib across 2 version ranges.

< 1.15.13 >= 1.16.0-0, < 1.16.5

Fixed in 1.15.13 or 1.16.5, depending on the release line you run. How to fix ↓

Also tracked for

golang · Bitnami
golang-1.15 · Debian:11

The same CVE-2021-33198 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. One of the packages in the stdlib is math/big, which offers arbitrary-precision arithmetic operations on integers and rational numbers. The Rat.SetString and Rat.UnmarshalText functions in the math/big package allow users to set the value of a rational number. However, these functions have a vulnerability that can lead to a panic or an unrecoverable fatal error when provided with inputs containing very large exponents.

Vulnerability Detail

The vulnerability (CVE-2021-33198) arises from a flaw in the Rat.SetString and Rat.UnmarshalText functions of the math/big package. When these functions receive inputs with extremely large exponents, they may trigger a panic or an unrecoverable fatal error. This can result in a denial of service (DoS) situation or cause the program to terminate unexpectedly. Attackers can potentially exploit this vulnerability to disrupt the availability of affected applications or execute arbitrary code.

How To Fix

Latest published version: go1.25.5 as of 22 Oct 2026

go get stdlib@vgo1.25.5

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 1.15.13 1.15.13
```
go get stdlib@v1.15.13
```
>= 1.16.0-0, < 1.16.5 1.16.5
```
go get stdlib@v1.16.5
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. However, developers can consider implementing input validation to prevent the use of inputs with excessively large exponents. By validating and limiting the range of exponents allowed, the risk of triggering the vulnerability can be reduced.

Conclusion

The vulnerability (CVE-2021-33198) in the math/big package of the Go stdlib can lead to a panic or fatal error when provided with inputs containing large exponents. It is crucial to update the stdlib package to versions 1.15.13 or 1.16.5 (or later) to mitigate the risk. Developers should also consider implementing input validation to limit the range of exponents allowed. For further assistance and support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ

What is the impact of this vulnerability?

This vulnerability can lead to a panic or an unrecoverable fatal error in applications using the affected functions from the math/big package. It can result in a denial of service (DoS) situation or unexpected termination of the program.

Can this vulnerability be exploited remotely?

Yes, this vulnerability can be exploited remotely if an attacker can provide inputs with large exponents to the vulnerable functions. By triggering a panic or fatal error, the attacker can disrupt the availability of the affected application.

Are all versions of the stdlib package affected?

No, not all versions of the stdlib package are affected. Versions 1.15.13 and 1.16.5 (and later) include the necessary patches to address this vulnerability. Developers should ensure they are using an updated version of the stdlib package.

Is there a known exploit for this vulnerability?

There is no known exploit available for this vulnerability at the time of this report. However, it is advisable to apply the recommended updates to mitigate the risk.