GitHub Advisoryadvisory · Go

GHSA-ppp9-7jff-5vj2 golang.org/x/text/language Out-of-bounds Read vulnerability

HIGH Published 2022-12-26 Modified 2025-04-14 Official page ↗
Aliases
CVE-2021-38561
Ecosystem
Go
Packages
golang.org/x/text
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Reviewed
2023-01-09

Affected packages

• Go golang.org/x/text: < 0.3.7 → fixed in 0.3.7

Description

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Related

Alias · CVE (1)

  • CVE-2021-38561 golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References