CVE-2021-33194High· 7.5▾ TwilightA flaw was found in golang. An attacker can craft an input to ParseFragment within parse.go that would cause it to enter an infinite loop and never return. The greatest threat to the system is of availability.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
7.5%
Last analysed / modified upstream
A flaw was found in golang. An attacker can craft an input to ParseFragment within parse.go that would cause it to enter an infinite loop and never return. The greatest threat to the system is of availability.
golang: x/net/html: infinite loop in ParseFragment — rated Moderate by Red Hat. Released 2021-05-20, updated 2026-09-17.
Affected:
Fixed:
No fix planned:
Not affected:
For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
For Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:
https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html https://access.redhat.com/errata/RHSA-2021:4627 For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html
Details on how to access this content are available at https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2021:2438 For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
Details on how to access this content are available at https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2021:3759
Affected packages:
golang.org/x/net < 0.0.0-20210520170846-37e1c6afe023Patched in:
golang.org/x/net 0.0.0-20210520170846-37e1c6afe023Connected by shared product, vendor, weakness, or advisory.
CVE-2020-26160High· 7.5jwt-go: access restriction bypass vulnerability (CVE-2020-26160)
CVE-2021-29482High· 7.5ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)
CVE-2025-4673Medium· 6.8net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)
CVE-2022-23526High· 7.5helm: Denial of service through schema file (CVE-2022-23526)
CVE-2020-14040High· 7.5golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
CVE-2026-25680Medium· 6.5golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)