CVE-2020-14040
golang.org/x/text Infinite loop
Reported by mitre · Published June 17, 2020
golang.org/x/text is fixed in v0.3.3 and 0.3.3 (Go Modules)
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| golang.org/x/text | Go Modules | v0.3.3, 0.3.3 |
| golang.org/x/text/encoding/unicode | Go Modules | 0.3.3 |
| golang-bin | Amazon Linux | 1.13.15-1.amzn2.0.1 |
| golang | Amazon Linux | 1.13.15-1.amzn2.0.1 |
| vt-cli | Chainguard | 1.0.0-r3 |
| vt-cli | Wolfi | 1.0.0-r3 |
| k3d | Chainguard | 5.6.0-r11 |
| golang-src | Amazon Linux | 1.13.15-1.amzn2.0.1 |
| golang-tests | Amazon Linux | 1.13.15-1.amzn2.0.1 |
| golang-misc | Amazon Linux | 1.13.15-1.amzn2.0.1 |
| golang-race | Amazon Linux | 1.13.15-1.amzn2.0.1 |
| k3d | Wolfi | 5.6.0-r11 |
4 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| amazon:2 | golang-bin | 0 |
| amazon:2 | golang | 0 |
| chainguard | vt-cli | 0 |
| wolfi | vt-cli | 0 |
| chainguard | k3d | 0 |
| amazon:2 | golang-src | 0 |
| golang.org | x/text | 0 |
| amazon:2 | golang-tests | 0 |
| amazon:2 | golang-misc | 0 |
| amazon:2 | golang-race | 0 |
| chainguard | dex-k8s-authenticator | * |
| golang.org | x/text/encoding/unicode | 0 |
| wolfi | k3d | 0 |
| amazon:2 | golang-docs | 0 |
| golang | text | |
| n/a | n/a | * |
Timeline
- Jun 17, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Mar 6, 2026 Distribution Patch (37 in total, the first dated here)
- Mar 6, 2026 Security Advisory (40 in total, the first dated here)
- Sep 5, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-14040
vulnetix vdb fixes CVE-2020-14040Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-14040/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- FEDORA-2020-a55f130272 vendor-advisoryx_refsource_FEDORA
- https://github.com/golang/go/issues/39491 url
- https://github.com/golang/text/commit/23ae387dee1f90d29a23c0e87ee0b46038fbed0e patch
- https://github.com/advisories/GHSA-5rcv-m4m3-hfh7 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-14040 advisory