modules:
  - module: golang.org/x/text
    versions:
      - fixed: 0.3.3
    vulnerable_at: 0.3.2
    packages:
      - package: golang.org/x/text/encoding/unicode
        symbols:
          - utf16Decoder.Transform
        derived_symbols:
          - bomOverride.Transform
      - package: golang.org/x/text/transform
        symbols:
          - String
summary: Infinite loop in golang.org/x/text
description: |
    An attacker could provide a single byte to a UTF16 decoder instantiated with
    UseBOM or ExpectBOM to trigger an infinite loop if the String function on
    the Decoder is called, or the Decoder is passed to transform.String.
    If used to parse user supplied input, this may be used as a denial of service
    vector.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2020-14040
ghsas:
  - GHSA-5rcv-m4m3-hfh7
credits:
  - '@abacabadabacaba'
  - Anton Gyllenberg
references:
  - fix: https://go.dev/cl/238238
  - fix: https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e
  - report: https://go.dev/issue/39491
  - web: https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0