PT-2021-20903 · Go.Uuid · Go.Uuid

Josselin-C · Published 2021-06-02 · Updated 2026-04-01 · CVE-2021-3538

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: github.com/satori/go.uuid versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45

Description: A flaw in the github.com/satori/go.uuid package causes the generated UUIDs to be predictable for an attacker due to insecure randomness in the g.rand.Read function. This issue can result in predictable UUIDs and possible collisions, as the random data used to create UUIDs can contain zeros.

Recommendations: For versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45, consider using an alternative method to generate UUIDs that ensures secure randomness, or refrain from using the g.rand.Read function until a patch is available. As a temporary workaround, consider implementing additional checks to detect and handle predictable UUIDs.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CLEANSTART-2026-AP81168

CLEANSTART-2026-EE52954

CLEANSTART-2026-KW24478

CLEANSTART-2026-LB23787

CLEANSTART-2026-MT27167

CLEANSTART-2026-OS42112

CLEANSTART-2026-PE63912

CLEANSTART-2026-QY63788

CLEANSTART-2026-VZ76006

CVE-2021-3538

GHSA-33M6-Q9V5-62R7

GO-2022-0244

SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488

Affected Products

Go.Uuid

References · 98

• https://nvd.nist.gov/vuln/detail/CVE-2025-58185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-15558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61725 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4673 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EE52954 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-VZ76006 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-MT27167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22871 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53547 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-PE63912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58187 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-OS42112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55198 · Security Note