Out-of-Bounds Read Vulnerability in Go Language Parsing by Google

CVE-2021-38561

What is CVE-2021-38561?

The Go programming language's text processing library, golang.org/x/text, is susceptible to an out-of-bounds read during the parsing of BCP 47 language tags. Specifically, versions prior to 0.3.7 exhibit improper index calculation, leading to potential application crashes or service disruptions when handling untrusted user input. This vulnerability may serve as a vector for denial-of-service attacks, potentially impacting applications that rely on this library for language processing.

References