golang.org/x/text (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package golang.org/x/text, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2020-14040 — CVSS 7.5 (high): The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite…
• CVE-2021-38561 — CVSS 7.5 (high): golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index…
• CVE-2022-32149 — CVSS 7.5 (high): An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to…