golang text vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Golang Text

7.5

CVSSv3

golang.org/x/text/language in golang.org/x/text prior to 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Golang Text

7.5

CVSSv3

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Golang Text

7.5

CVSSv3

The x/text package prior to 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM...

Golang Text Fedoraproject Fedora 32

3 Github repositories

7.5

CVSSv3

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Golang Go 1.15.4

6.1

CVSSv3

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Golang Networking

1 Github repository

5.3

CVSSv3

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of d...

Golang Go

7.5

CVSSv3

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the malici...

Golang Http2 Golang Go Fedoraproject Fedora 37 Fedoraproject Fedora 38 Fedoraproject Fedora 39 Netapp Astra Trident -Netapp Astra Trident Autosupport -

2 Github repositories

5.9

CVSSv3

A message-forgery issue exists in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash"...

Golang Crypto 2019-03-25 Debian Debian Linux 8.0 Debian Debian Linux 9.0

6.1

CVSSv3

Go prior to 1.14.8 and 1.15.x prior to 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Golang Go Fedoraproject Fedora 33 Opensuse Leap 15.1 Opensuse Leap 15.2 Oracle Communications Cloud Native Core Policy 1.5.0

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook