encoding/xml vulnerabilities

2 known vulnerabilities in encoding/xml from Go standard library. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  encoding/xml: Uncontrolled Recursion

  CVE-2022-30633Aug 10, 2022Go standard libraryEPSS 2.21%

  Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

• 7.5 High severity

  encoding/xml: Uncontrolled Recursion

  CVE-2022-28131Aug 10, 2022Go standard libraryEPSS 2.56%

  Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.