FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

go -- net/http: panic due to racy read of persistConn after handler panic

Affected packages
		go	<	1.16.7,1

Details

VuXML ID	880552c4-f63f-11eb-9d56-7186043316e9
Discovery	2021-06-21
Entry	2021-08-05

The Go project reports:

A net/http/httputil ReverseProxy can panic due to a race condition if its Handler aborts with ErrAbortHandler, for example due to an error in copying the response body. An attacker might be able to force the conditions leading to the race condition.

[source]

References

CVE Name	CVE-2021-36221
URL	https://github.com/golang/go/issues/46866