# CVE-2021-38561: GO-2021-0113 - Out-of-bounds read in golang.org/x/text/language

Source: https://junglewise.ai/threats/cve-2021-38561-golang-org-x-text-language-out-of-bounds-read-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-10-06  
License: CC BY 4.0 with a link back

CVE-2021-38561 · Severity: low · CVSS 3.1 · Published 2021-10-06

Out-of-bounds read in golang.org/x/text/language

Technologies: [golang.org/x/text (Go)](https://junglewise.ai/threats/technologies/golang-org-x-text). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2021-38561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-38561 being exploited in the wild.

**How severe is CVE-2021-38561?** Low severity, with a CVSS score of 3.1, published 6 October 2021.

**Which products and versions are affected?** golang.org/x/text (Go) SEMVER:introduced=0,fixed=0.3.7.

**Is there a fix for CVE-2021-38561?** Yes. golang.org/x/text (Go): upgrade to 0.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-38561?** Check whether you run golang.org/x/text (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/text (Go): upgrade to 0.3.7 or later

  ```sh
  go get golang.org/x/text@v0.3.7
  ```


## Affected products

- golang.org/x/text (Go) SEMVER:introduced=0,fixed=0.3.7

## Identifiers

- CVE-2021-38561
- GHSA-ppp9-7jff-5vj2
- GO-2021-0113

## Related threats

- [golang.org/x/text panic in precis nickname mapping](https://junglewise.ai/threats/cve-2026-56851-go-2026-6629-panic-parsing-crafted-input-in-x-text-secure-precis)
- [Go x/text infinite loop in unicode/norm](https://junglewise.ai/threats/cve-2026-56852-go-x-text-infinite-loop-in-unicode-norm)
- [GO-2022-1059 - Denial of service via crafted Accept-Language header in golang.org/x/text/language](https://junglewise.ai/threats/cve-2022-32149-golang-org-x-text-language-denial-of-service-via-crafted-accept)
- [GO-2020-0015 - Infinite loop when decoding some inputs in golang.org/x/text](https://junglewise.ai/threats/cve-2020-14040-golang-org-x-text-infinite-loop)