CVE catalog

CVE-2021-3538

golang-github-satori-go.uuid: CVE-2021-3538

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.31% · Oct 25, 2026

A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-satori-go.uuidsid1.2.0-3not affected
Debiangolang-github-satori-go.uuidforky1.2.0-3not affected
Debiangolang-github-satori-go.uuidtrixie1.2.0-3not affected
Debiangolang-github-satori-go.uuidbookworm1.2.0-3not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-satori-go.uuidsourcesidNot affectedunimportantNot reportedNot reported
Debiangolang-github-satori-go.uuidsourceforkyNot affectedunimportantNot reportedNot reported
Debiangolang-github-satori-go.uuidsourcetrixieNot affectedunimportantNot reportedNot reported
Debiangolang-github-satori-go.uuidsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]