modules:
  - module: golang.org/x/text
    versions:
      - fixed: 0.3.7
    vulnerable_at: 0.3.6
    packages:
      - package: golang.org/x/text/language
        symbols:
          - Parse
        derived_symbols:
          - MatchStrings
          - MustParse
          - ParseAcceptLanguage
description: |
    Due to improper index calculation, an incorrectly formatted language tag can cause Parse
    to panic via an out of bounds read. If Parse is used to process untrusted user inputs,
    this may be used as a vector for a denial of service attack.
published: 2021-10-06T17:51:21Z
cves:
  - CVE-2021-38561
ghsas:
  - GHSA-ppp9-7jff-5vj2
credit: Guido Vranken
references:
  - fix: https://go.dev/cl/340830
  - fix: https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f