GitHub Advisoryadvisory · Go

GHSA-93m7-c69f-5cfj xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service

HIGH Published 2022-10-07 Modified 2025-01-22 Official page ↗
Aliases
CVE-2020-25614
Ecosystem
Go
Packages
github.com/antchfx/xmlquery
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-119, CWE-20
Reviewed
2022-10-07

Affected packages

• Go github.com/antchfx/xmlquery: < 1.3.1 → fixed in 1.3.1

Description

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.

Related

Alias · CVE (1)

  • CVE-2020-25614 xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of… vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-20 Improper Input Validation weakness

References