CVE-2021-38561: 
NixOS vulnerability analysis and mitigation

golang.org/x/text/language in golang.org/x/text before version 0.3.7 contains a vulnerability that can cause a panic with an out-of-bounds read during BCP 47 language tag parsing. The vulnerability was assigned CVE-2021-38561 and affects the index calculation handling during language tag parsing (CVE Mitre).

The vulnerability is caused by mishandled index calculations during BCP 47 language tag parsing in the golang.org/x/text/language package. The issue is classified as an out-of-bounds read (CWE-125) vulnerability. The CVSS v3.1 base score is 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When parsing untrusted user input, this vulnerability can be exploited as a vector for a denial-of-service attack. The impact primarily affects the availability of the service, as indicated by the CVSS metrics showing high availability impact but no confidentiality or integrity impacts (NVD).

The vulnerability has been fixed in golang.org/x/text version 0.3.7. Users should upgrade to this version or later to mitigate the vulnerability. The fix was implemented through a patch that addresses the index calculation issue (Go Source).