CVE-2021-36221: Panic in ReverseProxy in net/http/httputil
Summary
CVE-2021-36221: Panic in ReverseProxy in net/http/httputil. Affects stdlib across 2 version ranges.
< 1.15.15
>= 1.16.0-0, < 1.16.7
Fixed in 1.15.15 or 1.16.7, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-36221 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. The net/http/httputil package within stdlib includes the ReverseProxy type, which is used to implement a reverse proxy server. The ReverseProxy serves as an intermediary between clients and backend servers, forwarding client requests and returning backend responses. This vulnerability affects versions 0 through 1.15.14 and 1.16.0 through 1.16.6 of the stdlib package.
Vulnerability Detail
The ReverseProxy in net/http/httputil can encounter a panic when attempting to copy a proxied response body. This panic occurs due to a problem during the copying process. An attacker can exploit this vulnerability by sending a specially crafted request that triggers the panic, potentially causing a denial-of-service (DoS) condition. The impact of this vulnerability can vary depending on the specific implementation and usage of the ReverseProxy, but it has the potential to disrupt the availability of affected systems.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.15.151.15.15go get stdlib@v1.15.15 -
>= 1.16.0-0, < 1.16.71.16.7go get stdlib@v1.16.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the stdlib package is not immediately feasible, a possible workaround is to implement custom error handling and recovery mechanisms in the affected code. By catching and handling panics that occur during the copying of proxied response bodies, developers can prevent the panic from propagating and potentially causing a DoS condition. Here is an example of how to implement such error handling:
func handleReverseProxy(w http.ResponseWriter, r *http.Request) {
defer func() {
if err := recover(); err != nil {
// Handle the panic and prevent it from propagating
log.Println("Recovered from panic:", err)
// Additional error handling logic
}
}()
// Perform the reverse proxy logic
// ...
}
Conclusion
The panic vulnerability in ReverseProxy in net/http/httputil can lead to a denial-of-service (DoS) condition. It is crucial to update the stdlib package to version 1.15.15 or 1.16.7 to mitigate this vulnerability. If immediate updating is not possible, implementing custom error handling and recovery mechanisms can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can potentially lead to a denial-of-service (DoS) condition by causing a panic in the ReverseProxy implementation. The impact may vary depending on the specific usage and implementation of the ReverseProxy.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
While specific exploits for this vulnerability have not been disclosed, it is important to address it promptly to prevent potential attacks. Attackers could potentially craft malicious requests to trigger the panic and disrupt the availability of affected systems.
Yes, a patch is available in versions 1.15.15 and 1.16.7 of the stdlib package. It is recommended to update to one of these versions to fix the vulnerability.
If updating the stdlib package is not immediately feasible, you can implement custom error handling and recovery mechanisms in the affected code. By catching and handling panics that occur during the copying of proxied response bodies, you can prevent the panic from propagating and potentially causing a DoS condition.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
