CVE-2021-34558: Panic on certain certificates in crypto/tls
Summary
CVE-2021-34558: Panic on certain certificates in crypto/tls. Affects stdlib across 2 version ranges.
< 1.15.14
>= 1.16.0-0, < 1.16.6
Fixed in 1.15.14 or 1.16.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-34558 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. The crypto/tls package in stdlib is responsible for implementing TLS (Transport Layer Security) protocols, which are used to secure network communications. This vulnerability affects the crypto/tls package in versions 0.0.0 to 1.15.14 and 1.16.0-0 to 1.16.6. It can lead to panics in crypto/tls clients and net/http clients performing HTTPS requests when provided a certificate of the wrong type for the negotiated parameters.
Vulnerability Detail
The vulnerability arises when a client using the crypto/tls package is given a certificate that does not match the negotiated parameters. This can cause the client to panic, resulting in a crash or unexpected termination of the program. The net/http clients performing HTTPS requests are also affected by this vulnerability. The impact of this vulnerability can range from denial of service to potential security breaches if the panic is not handled properly.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.15.141.15.14go get stdlib@v1.15.14 -
>= 1.16.0-0, < 1.16.61.16.6go get stdlib@v1.16.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Go stdlib package is not immediately feasible, a possible workaround is to ensure that the correct type of certificate is provided to the client. This can be done by validating the certificate type before passing it to the crypto/tls or net/http clients. Here is an example of how to check the certificate type in Go:
cert, err := tls.LoadX509KeyPair(certFile, keyFile)
if err != nil {
// handle error
}
if _, ok := cert.PrivateKey.(*rsa.PrivateKey); !ok {
// handle certificate of wrong type
}
Conclusion
In conclusion, the CVE-2021-34558 vulnerability in the crypto/tls package of the Go stdlib can lead to panics and unexpected termination of programs when provided with a certificate of the wrong type. It is crucial to update the affected package to the fixed versions or implement the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The impact of this vulnerability can range from denial of service to potential security breaches if the panic is not handled properly. It can lead to program crashes or unexpected termination.
Versions 0.0.0 to 1.15.14 and 1.16.0-0 to 1.16.6 of the Go stdlib package are affected by this vulnerability.
To fix this vulnerability, it is recommended to update the Go stdlib package to version 1.15.14 or 1.16.6, depending on the version being used.
Yes, net/http clients performing HTTPS requests are also affected by this vulnerability.
If updating the Go stdlib package is not immediately feasible, a possible workaround is to ensure that the correct type of certificate is provided to the client.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
