Golang Org X Text Secure Precis
Monthly
Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.
Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.