HighCVSS 7.5
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Vendor
encoding vulnerabilities
5 published CVES affecting encoding, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 5
- Critical
- 0
- High
- 5
- Medium
- 0
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest encoding CVEs
Newest publication first
-
-
HighCVSS 7.5
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
-
HighCVSS 7.5
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
-
HighCVSS 7.5
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
-
HighCVSS 7.5
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.