Security readout for executives and security teams
Plain-English summary
This issue affects Go software using golang.org/x/text/language before version 0.3.7. A malicious or malformed language tag can make the application panic. The business impact is availability: exposed services that parse untrusted locale or language input could be knocked offline.
Executive priority
Treat as a high-priority dependency update for exposed Go services. It is not described as data theft or remote code execution, but it can disrupt service availability without authentication.
Technical view
The vulnerable package mishandles index calculation while parsing BCP 47 language tags, causing an out-of-bounds read and panic. CVE data maps this to CWE-125 with CVSS 3.1 score 7.5, availability impact only. The vulnerable range is golang.org/x/text before 0.3.7.
Likely exposure
Most likely exposure is Go applications or services that directly or transitively include golang.org/x/text/language before 0.3.7 and parse user-controlled language tags, locale parameters, or Accept-Language-style data.
Exploitation context
The sources describe denial of service through untrusted input parsing. The bundle does not show CISA KEV listing or cited evidence of active exploitation, so active exploitation should not be assumed.
Researcher notes
Focus triage on transitive dependency reachability, not just presence. Confirm whether untrusted BCP 47 tags reach the language parser. Evidence provided does not identify affected downstream products or exploitation in the wild.
Mitigation direction
- Inventory Go applications for golang.org/x/text versions before 0.3.7.
- Upgrade golang.org/x/text to 0.3.7 or later, following vendor guidance.
- Rebuild and redeploy affected binaries after dependency updates.
- Restrict or validate untrusted language tag input where immediate upgrading is delayed.
- Prioritize internet-facing services that parse locale or language preferences.
Validation and detection
- Check dependency manifests and SBOMs for golang.org/x/text before 0.3.7.
- Identify code paths using golang.org/x/text/language with external input.
- Confirm rebuilt artifacts include the remediated dependency version.
- Review availability monitoring for unexplained panics around language parsing.
- Retest affected user-input paths after dependency updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-38561 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://groups.google.com/g/golang-announceCVE reference
- https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56fCVE reference
- https://deps.dev/advisory/OSV/GO-2021-0113CVE reference
- https://pkg.go.dev/golang.org/x/text/languageCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.