id: GO-2021-0245
modules:
    - module: std
      versions:
        - fixed: 1.15.15
        - introduced: 1.16.0-0
        - fixed: 1.16.7
      vulnerable_at: 1.16.6
      packages:
        - package: net/http/httputil
          symbols:
            - ReverseProxy.ServeHTTP
          skip_fix: 'TODO: revisit this reason (fix appears to not work with Go <1.18)'
summary: Panic in ReverseProxy in net/http/httputil
description: |-
    ReverseProxy can panic after encountering a problem copying a proxied response
    body.
published: 2022-02-17T17:32:24Z
cves:
    - CVE-2021-36221
credits:
    - Andrew Crump
references:
    - fix: https://go.dev/cl/333191
    - fix: https://go.googlesource.com/go/+/b7a85e0003cedb1b48a1fd3ae5b746ec6330102e
    - web: https://groups.google.com/g/golang-announce/c/uHACNfXAZqk
    - report: https://go.dev/issue/46866
review_status: REVIEWED