CVE-2021-4236

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan NULL Pointer Dereference pada web project web. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.

Rincian

Terbit di NVD

27 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f patch · advisory pihak ketiga
• https://pkg.go.dev/vuln/GO-2021-0107 exploit · patch · advisory pihak ketiga