GO-2021-0234
Infinite loop when decoding inputs in encoding/xml
At a glance
- Published
- Updated
- CVE
- CVE-2021-27918
- Aliases
- BIT-golang-2021-27918
Description
The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.15.9, introduced 1.16.0-0, fixed 1.16.1 |
References
- https://go.dev/cl/300391 FIX
- https://go.googlesource.com/go/+/d0b79e3513a29628f3599dc8860666b6eed75372 FIX
- https://go.dev/issue/44913 REPORT
- https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |