CVE-2020-14040
mediumpriority · track · 31EPSS 0.018 · 79 %ileDEEURUUSEPSS · scored 2026-10-27
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (35)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-0510IBM DB2: Mehrere SchwachstellenDeutsch2022-06-29csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.
- WID-SEC-W-2023-2981Red Hat OpenShift: Mehrere SchwachstellenDeutsch2020-08-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen oder weitere nicht definierte Auswirkungen zu erzielen.
- GHSA-5rcv-m4m3-hfh7golang.org/x/text Infinite loop2021-05-18ghsa · osvUS
Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. ### Specific Go Packages Affected golang.org/x/text/encoding/unicode golang.org/x/text/transform
- GO-2020-0015Infinite loop when decoding some inputs in golang.org/x/text2021-04-14vendor · osvUS
An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to transform.String. If used to parse user supplied input, this may be used as a denial of service vector.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (50)
External citations — patches, advisories, analysis.
- http://www.nsfocus.net/vulndb/48793cnnvd
- https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-14040cnnvd
- https://packetstormsecurity.com/files/158512/Red-Hat-Security-Advisory-2020-3087-01.htmlcnnvd
- https://packetstormsecurity.com/files/158798/Red-Hat-Security-Advisory-2020-3372-01.htmlcnnvd
- https://packetstormsecurity.com/files/159095/Red-Hat-Security-Advisory-2020-3578-01.htmlcnnvd
- https://packetstormsecurity.com/files/159187/Red-Hat-Security-Advisory-2020-3727-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan