data/reports: add GO-2026-5970 - data/reports/GO-2026-5970.yaml Fixes golang/vulndb#5970 Change-Id: I2220f455dd62fe45239420a9a66f65156a6a6964 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/799680 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <neal@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com>
diff --git a/data/cve/v5/GO-2026-5970.json b/data/cve/v5/GO-2026-5970.json new file mode 100644 index 0000000..2dbdd8d --- /dev/null +++ b/data/cve/v5/GO-2026-5970.json
@@ -0,0 +1,136 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.0", + "cveMetadata": { + "cveId": "CVE-2026-56852" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc" + }, + "title": "Infinite loop on invalid input in golang.org/x/text", + "descriptions": [ + { + "lang": "en", + "value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes." + } + ], + "affected": [ + { + "vendor": "golang.org/x/text", + "product": "golang.org/x/text/unicode/norm", + "collectionURL": "https://pkg.go.dev", + "packageName": "golang.org/x/text/unicode/norm", + "versions": [ + { + "version": "0", + "lessThan": "0.39.0", + "status": "affected", + "versionType": "semver" + } + ], + "programRoutines": [ + { + "name": "nextComposed" + }, + { + "name": "Form.Append" + }, + { + "name": "Form.AppendString" + }, + { + "name": "Form.Bytes" + }, + { + "name": "Form.FirstBoundary" + }, + { + "name": "Form.FirstBoundaryInString" + }, + { + "name": "Form.IsNormal" + }, + { + "name": "Form.IsNormalString" + }, + { + "name": "Form.LastBoundary" + }, + { + "name": "Form.NextBoundary" + }, + { + "name": "Form.NextBoundaryInString" + }, + { + "name": "Form.Properties" + }, + { + "name": "Form.PropertiesString" + }, + { + "name": "Form.QuickSpan" + }, + { + "name": "Form.QuickSpanString" + }, + { + "name": "Form.Span" + }, + { + "name": "Form.SpanString" + }, + { + "name": "Form.String" + }, + { + "name": "Form.Transform" + }, + { + "name": "Iter.Init" + }, + { + "name": "Iter.InitString" + }, + { + "name": "Iter.Next" + }, + { + "name": "Iter.Seek" + }, + { + "name": "normReader.Read" + }, + { + "name": "normWriter.Write" + } + ], + "defaultStatus": "unaffected" + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "lang": "en", + "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')" + } + ] + } + ], + "references": [ + { + "url": "https://go.dev/issue/80142" + }, + { + "url": "https://go.dev/cl/794100" + }, + { + "url": "https://pkg.go.dev/vuln/GO-2026-5970" + } + ] + } + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5970.json b/data/osv/GO-2026-5970.json new file mode 100644 index 0000000..b59324c --- /dev/null +++ b/data/osv/GO-2026-5970.json
@@ -0,0 +1,80 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5970", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-56852" + ], + "summary": "Infinite loop on invalid input in golang.org/x/text", + "details": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", + "affected": [ + { + "package": { + "name": "golang.org/x/text", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.39.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "golang.org/x/text/unicode/norm", + "symbols": [ + "Form.Append", + "Form.AppendString", + "Form.Bytes", + "Form.FirstBoundary", + "Form.FirstBoundaryInString", + "Form.IsNormal", + "Form.IsNormalString", + "Form.LastBoundary", + "Form.NextBoundary", + "Form.NextBoundaryInString", + "Form.Properties", + "Form.PropertiesString", + "Form.QuickSpan", + "Form.QuickSpanString", + "Form.Span", + "Form.SpanString", + "Form.String", + "Form.Transform", + "Iter.Init", + "Iter.InitString", + "Iter.Next", + "Iter.Seek", + "nextComposed", + "normReader.Read", + "normWriter.Write" + ] + } + ] + } + } + ], + "references": [ + { + "type": "REPORT", + "url": "https://go.dev/issue/80142" + }, + { + "type": "FIX", + "url": "https://go.dev/cl/794100" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5970", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/reports/GO-2026-5970.yaml b/data/reports/GO-2026-5970.yaml new file mode 100644 index 0000000..520bd07 --- /dev/null +++ b/data/reports/GO-2026-5970.yaml
@@ -0,0 +1,49 @@ +id: GO-2026-5970 +modules: + - module: golang.org/x/text + versions: + - fixed: 0.39.0 + vulnerable_at: 0.38.0 + packages: + - package: golang.org/x/text/unicode/norm + symbols: + - nextComposed + derived_symbols: + - Form.Append + - Form.AppendString + - Form.Bytes + - Form.FirstBoundary + - Form.FirstBoundaryInString + - Form.IsNormal + - Form.IsNormalString + - Form.LastBoundary + - Form.NextBoundary + - Form.NextBoundaryInString + - Form.Properties + - Form.PropertiesString + - Form.QuickSpan + - Form.QuickSpanString + - Form.Span + - Form.SpanString + - Form.String + - Form.Transform + - Iter.Init + - Iter.InitString + - Iter.Next + - Iter.Seek + - normReader.Read + - normWriter.Write +summary: Infinite loop on invalid input in golang.org/x/text +description: | + A norm.Iter can enter an infinite loop when handling input + containing invalid UTF-8 bytes. +references: + - report: https://go.dev/issue/80142 + - fix: https://go.dev/cl/794100 +cve_metadata: + id: CVE-2026-56852 + cwe: 'CWE-835: Loop with Unreachable Exit Condition (''Infinite Loop'')' +source: + id: go-security-team + created: 2026-07-10T16:24:27.891526-07:00 +review_status: REVIEWED