CVE-2021-38561: golang.org/x/text/language Out-of-bounds Read vulnerability

December 26, 2022 (updated April 14, 2025)

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

References

deps.dev/advisory/OSV/GO-2021-0113
github.com/advisories/GHSA-ppp9-7jff-5vj2
go.dev/cl/340830
go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
groups.google.com/g/golang-announce
nvd.nist.gov/vuln/detail/CVE-2021-38561
pkg.go.dev/golang.org/x/text/language
pkg.go.dev/vuln/GO-2021-0113

Code Behaviors & Features

Detect and mitigate CVE-2021-38561 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →