Go Standard Library Encoding/Xml vulnerabilities
3 vulnerabilities
Known vulnerabilities in Go Standard Library Encoding/Xml, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-28131debiangolang-1.15+8
EPSS score2.42%
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.CVE-2022-30633debiangolang-1.19+6EPSS score2.09%
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.CVE-2026-56859chainguardaactl+4732EPSS score0.57%
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.