CVE-2021-31525: Panic due to large headers in net/http and golang.org/x/net/http/httpguts
Summary
CVE-2021-31525: Panic due to large headers in net/http and golang.org/x/net/http/httpguts. Affects stdlib across 2 version ranges.
< 1.15.12
>= 1.16.0-0, < 1.16.4
Fixed in 1.15.12 or 1.16.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang.org/x/net · Go
- golang-1.15 · Debian:11
The same CVE-2021-31525 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is the Go standard library (stdlib) and the golang.org/x/net package. The stdlib package provides a collection of packages for building HTTP servers and clients, while the golang.org/x/net package contains additional networking libraries. These packages are widely used in Go applications for handling HTTP requests and responses. However, a vulnerability has been discovered that allows a malicious HTTP server or client to cause a panic in the net/http client or server. This vulnerability affects the Transport and Client components and can lead to a program crash. The Server component is not vulnerable by default, but can be if the default max header size is overridden. The golang.org/x/net/http2/h2c package and the HeaderValuesContainsToken function in golang.org/x/net/http/httpguts are also affected.
Vulnerability Detail
The vulnerability arises when the net/http client or server attempts to read a very large header. If the header size exceeds a certain threshold (over 7MB on 64-bit architectures or over 4MB on 32-bit ones), an unrecoverable panic occurs. This can be exploited by a malicious server to crash the client or a malicious client to crash the server. The panic occurs in the ReadRequest and ReadResponse functions of the net/http package. The golang.org/x/net/http2/h2c package and the HeaderValuesContainsToken function in golang.org/x/net/http/httpguts are also susceptible to this vulnerability. The impact of this vulnerability is a denial-of-service (DoS) condition, where the affected program crashes and becomes unresponsive.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.15.121.15.12go get stdlib@v1.15.12 -
>= 1.16.0-0, < 1.16.41.16.4go get stdlib@v1.16.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest versions is not immediately feasible, a workaround can be implemented by limiting the maximum header size in the affected components. For the net/http package, the maximum header size can be set using the Server.MaxHeaderBytes configuration option. By setting this value to a lower limit, such as 1MB, the program can be protected from crashing due to large headers. However, it is important to note that this workaround may impact the functionality of the application if legitimate requests require larger headers. Therefore, it is recommended to update to the latest versions as soon as possible.
Conclusion
In conclusion, the CVE-2021-31525 vulnerability in the net/http and golang.org/x/net/http/httpguts packages can be exploited by a malicious server or client to cause a panic in the affected components. This can lead to a denial-of-service condition where the program crashes. To mitigate this vulnerability, it is recommended to update to the latest versions of the Go standard library and its dependencies. Additionally, setting a lower limit for the maximum header size in the affected components can serve as a temporary workaround. Regularly updating the Go standard library and staying informed about security vulnerabilities is crucial for maintaining the security of Go applications.
See every vulnerability recorded for stdlib →
FAQ
The impact of this vulnerability is a denial-of-service (DoS) condition, where the affected program crashes and becomes unresponsive.
The net/http client and server components, as well as the golang.org/x/net/http2/h2c package and the HeaderValuesContainsToken function in golang.org/x/net/http/httpguts, are affected by this vulnerability.
Yes, a malicious server can exploit this vulnerability to crash the net/http client.
Yes, a malicious client can exploit this vulnerability to crash the net/http server if the Server.MaxHeaderBytes configuration option is set to a higher value.
No, the net/http server is not vulnerable by default. However, if the Server.MaxHeaderBytes configuration option is overridden with a higher value, the server can become vulnerable.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
