FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

go -- net/http: panic due to racy read of persistConn after handler panic

Affected packages
go < 1.16.7,1

Details

VuXML ID 880552c4-f63f-11eb-9d56-7186043316e9
Discovery 2021-06-21
Entry 2021-08-05

The Go project reports:

A net/http/httputil ReverseProxy can panic due to a race condition if its Handler aborts with ErrAbortHandler, for example due to an error in copying the response body. An attacker might be able to force the conditions leading to the race condition.

References

CVE Name CVE-2021-36221
URL https://github.com/golang/go/issues/46866