CVE-2021-41772 Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting ZIP Archive Handling in Go Two vulnerabilities related to ZIP archive handling in Go have been reported. CVE-2021-41772, published on November 8, 2021, allows a panic via a crafted ZIP archive with an invalid name or empty filename field. CVE-2024-0450, published on March 19, 2024, involves issues with quoted ZIP files. 2 sources 41

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)