Infinite loop on invalid input in golang.org/x/text

Description

References

• go.dev/issue/80142 · REPORT
• go.dev/cl/794100 · FIX
• pkg.go.dev/vuln/GO-2026-5970

More vulnerabilities in golang.org/x/text

• CVE-2026-56851HIGH 7.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
• CVE-2021-38561HIGH 7.5golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index …
• CVE-2022-32149HIGH 7.5An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to pars…
• CVE-2020-14040HIGH 7.5The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite lo…