CVE-2021-38561

Description

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Weakness classification

• nvd@nist.gov: CWE-125
• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-125

Primary references

• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Mailing List, Patch, Vendor Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory