Executive brief
The Go standard library's encoding/binary package contains functions that can enter an infinite loop when processing specially crafted invalid input. This vulnerability allows a remote attacker to cause a denial of service by sending malicious data to applications that use these functions, consuming CPU resources indefinitely and making the service unavailable.
Technical details
This vulnerability is a denial-of-service issue in the encoding/binary package's ReadUvarint and ReadVarint functions. When processing variable-length integer encoded data, these functions can receive input bytes that lack a proper termination condition, causing the read loop to continue indefinitely. The vulnerability requires network-accessible input to the affected functions but no authentication or special privileges. An attacker can exploit this by sending malformed varint-encoded data to an application, causing CPU resource exhaustion and service unavailability. The fix, implemented in Go 1.13.15 and 1.14.7, adds a check to limit the number of bytes read (maximum 10 bytes for 64-bit varint) before returning an overflow error. The same vulnerability was independently discovered and fixed in the third-party ulikunitz/xz Go library (patched in version 0.5.8).
Affected products
- Go Go standard library before 1.13.15 and 1.14.x before 1.14.7
- ulikunitz xz before 0.5.8
Timeline
- 2020-08-06: disclosed: Vulnerability disclosed via NVD
- 2020-08: other: Vulnerability reported to ulikunitz/xz project
- 2020: patched: Go 1.13.15 and 1.14.7 released with fixes
- 2020: patched: ulikunitz/xz version 0.5.8 released with fix
- 2021-12-16: advisory: Published to GitHub Advisory Database
- 2025-10-14: other: Advisory withdrawn from GitHub because alerts cannot be issued for Go standard library