golang.org/x/text/language Denial of service via crafted Accept-Language header
Overview
Source
ID
GHSA-69ch-w2m2-3vjp
Aliases
CVE-2022-32149
GO-2022-1059
Affected package
Description
The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.
### Specific Go Packages Affected golang.org/x/text/language
Impact
Severity
help_outline
Latest version of the CVSS score reported by the source of the advisory.
7.5 HIGH
Reference links
Summary
102.15k
Total packages affected
help_outline
Packages with at least one version that is affected by the advisory or has an affected dependency.
12.04k
Packages with a known fix
help_outline
Packages with versions affected by the advisory that have a greater version that is not affected.
7.62%
Total ecosystem affected
help_outline
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0, Fixed: 0.3.8
Patched/Unaffected
Affected