Golang Org X Text Unicode Norm
Monthly
Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attackers to cause an unrecoverable infinite loop by supplying input containing invalid UTF-8 bytes to a norm.Iter. Any Go service that Unicode-normalizes untrusted input using this widely-used supplementary library can be hung with a single malformed request, consuming CPU until the process is killed. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile), but the network-reachable, no-authentication, no-interaction profile makes it broadly triggerable.
Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attackers to cause an unrecoverable infinite loop by supplying input containing invalid UTF-8 bytes to a norm.Iter. Any Go service that Unicode-normalizes untrusted input using this widely-used supplementary library can be hung with a single malformed request, consuming CPU until the process is killed. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile), but the network-reachable, no-authentication, no-interaction profile makes it broadly triggerable.