CVE-2021-33194
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
02 / AFFECTED SOFTWARE
Affected packages
148 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
An attacker can craft an input to ParseFragment that causes it to enter an infinite loop and never return.
Go through 1.15.12 and 1.16.x through 1.16.4 has a golang.org/x/net/html infinite loop via crafted ParseFragment input.
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
05 / REFERENCES
Further evidence
- https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7
- https://groups.google.com/g/golang-announce/c/wPunbCPkWUg
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
- https://go.dev/cl/311090
- https://go.dev/issue/46288
- https://go.googlesource.com/net/+/37e1c6afe02340126705deced573a85ab75209d7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM
- https://nvd.nist.gov/vuln/detail/CVE-2021-33194
- https://pkg.go.dev/vuln/GO-2021-0238