CVE-2021-41771: Panic on invalid symbol tables in debug/macho
Summary
CVE-2021-41771: Panic on invalid symbol tables in debug/macho. Affects stdlib across 2 version ranges.
< 1.16.10
>= 1.17.0-0, < 1.17.3
Fixed in 1.16.10 or 1.17.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-41771 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem provides a collection of standard libraries for the Go programming language. One of the packages within stdlib is 'debug/macho', which offers functionality for working with Mach-O executable files on macOS and iOS platforms. Mach-O files contain executable code and other data used by the operating system. The 'debug/macho' package allows developers to parse and analyze these files. However, a vulnerability has been discovered in the package that can lead to a panic when processing invalid symbol tables within Mach-O files.
Vulnerability Detail
The vulnerability (CVE-2021-41771) arises when the 'File.ImportedSymbols' function is called on a loaded file that contains an invalid dynamic symbol table command. Specifically, if the encoded number of undefined symbols is greater than the number of symbols in the symbol table, a panic can occur. This vulnerability can be exploited by an attacker who can provide a malicious Mach-O file to a vulnerable application. The panic can potentially lead to a denial-of-service (DoS) condition or other unexpected behavior in the affected application.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.16.101.16.10go get stdlib@v1.16.10 -
>= 1.17.0-0, < 1.17.31.17.3go get stdlib@v1.17.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by ensuring that only trusted Mach-O files are processed by their applications. Implementing proper input validation and sanitization can help prevent the exploitation of this vulnerability.
Conclusion
The 'debug/macho' package in the Go ecosystem is vulnerable to a panic caused by invalid symbol tables in Mach-O files. This vulnerability can lead to a denial-of-service (DoS) condition or other unexpected behavior in affected applications. Developers should update their Go installation to the recommended versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can lead to a panic in applications that use the 'debug/macho' package to process Mach-O files. This panic can result in a denial-of-service (DoS) condition or other unexpected behavior.
Versions 1.16.0 to 1.16.9 and versions 1.17.0 to 1.17.2 of Go are affected by this vulnerability.
No, this vulnerability requires an attacker to provide a malicious Mach-O file to a vulnerable application. It cannot be exploited remotely over a network.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, developers can fix this vulnerability by updating their Go installation to version 1.16.10 or later, or version 1.17.3 or later.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
