module: golang.org/x/text
package: golang.org/x/text/encoding/unicode
additional_packages:
  - module: golang.org/x/text
    package: golang.org/x/text/transform
    symbols:
      - Transform
    versions:
      - fixed: v0.3.3
versions:
  - fixed: v0.3.3
description: |
  An attacker could provide a single byte to a UTF16 decoder instantiated with
  UseBOM or ExpectBOM to trigger an infinite loop if the String function on
  the Decoder is called, or the Decoder is passed to transform.String.
  If used to parse user supplied input, this may be used as a denial of service
  vector.
last_modified: 2021-06-07T12:00:00Z
cves:
  - CVE-2020-14040
credit: '@abacabadabacaba and Anton Gyllenberg'
symbols:
  - utf16Decoder.Transform
links:
  pr: https://go-review.googlesource.com/c/text/+/238238
  commit: https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e
  context:
    - https://go.dev/issue/39491
    - https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0