Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

概要

参考情報

• go.dev/cl/793360 · FIX
• go.dev/issue/80112 · REPORT
• pkg.go.dev/vuln/GO-2026-6629

golang.org/x/text のその他の脆弱性

• CVE-2026-56852高 7.5A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
• CVE-2021-38561高 7.5golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index …
• CVE-2022-32149高 7.5An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to pars…
• CVE-2020-14040高 7.5The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite lo…