GO-2020-0015
Infinite loop when decoding some inputs in golang.org/x/text
At a glance
- Published
- Updated
- CVE
- CVE-2020-14040
- Aliases
- GHSA-5rcv-m4m3-hfh7
Description
An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to transform.String. If used to parse user supplied input, this may be used as a denial of service vector.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/text | introduced 0, fixed 0.3.3 |
References
- https://go.dev/cl/238238 FIX
- https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e FIX
- https://go.dev/issue/39491 REPORT
- https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |