CVE-2021-27918

Description

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.03%• Percentile: 7%

Techniques & Countermeasures

• CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

• golang•go

  < 1.15.9 | ≥ 1.16.0, < 1.16.1

• Go•stdlib

  ≥ 1.16.0-0, < 1.16.1

References (5)

• https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw
• https://security.gentoo.org/glsa/202208-02
• https://go.dev/cl/300391
• https://go.googlesource.com/go/+/d0b79e3513a29628f3599dc8860666b6eed75372
• https://go.dev/issue/44913