Executive brief
A vulnerability exists in a Go programming library used for processing and normalizing text. When the library encounters specifically malformed or invalid text data, it can enter an infinite loop, causing the application to stop responding. This could allow an attacker to crash a service or cause a denial-of-service (DoS) by sending malicious input to an affected application.
Technical details
An infinite loop vulnerability exists in the Go 'x/text/unicode/norm' package when processing invalid or truncated UTF-8 sequences. The issue resides within the norm.Iter component and affects multiple symbols including Iter.Next, Form.Span, and Form.Transform. An attacker can trigger this condition by providing specially crafted, malformed UTF-8 input to an application that uses these normalization routines, leading to a denial-of-service (DoS) through CPU exhaustion. The vulnerability is fixed in version 0.39.0 of the golang.org/x/text module.
Affected products
- Go Project golang.org/x/text/unicode/norm before v0.39.0
Timeline
- 2026-06-24: disclosed: Issue reported to Go project
- 2026-07-14: advisory: Go Vulnerability Database report published
- 2026-07-21: advisory: NVD record published