Every CVE Search/ Get API key

CVE-2020-14040

golang.org/x/text Infinite loop

7.5 HighFix available

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.89%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
CVE-2020-14040
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-835
Updated
2026-11-02
CVE List No score

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
CVE-2020-14040
Updated
2026-11-02
EUVDEUVD-2021-0962 No score

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
EUVD-2021-0962
Updated
2026-11-03
GitHub AdvisoriesGHSA-5rcv-m4m3-hfh7 6.7

golang.org/x/text Infinite loop

Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Specific Go Packages Affected

golang.org/x/text/encoding/unicode golang.org/x/text/transform

Record
GHSA-5rcv-m4m3-hfh7
CVSS 3.1
6.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Weakness
CWE-400, CWE-835
Updated
2026-11-02
OSVAZL-44364 7.5

CVE-2020-14040 affecting package podman for versions less than 5.6.1-2

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
AZL-44364
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-44877 7.5

CVE-2020-14040 affecting package buildah for versions less than 1.41.4-2

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
AZL-44877
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 17 moreShow less
OSV 7.5

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
CVE-2020-14040
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-14040 7.5

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
DEBIAN-CVE-2020-14040
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-5rcv-m4m3-hfh7 7.5

golang.org/x/text Infinite loop

Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Specific Go Packages Affected

golang.org/x/text/encoding/unicode golang.org/x/text/transform

Record
GHSA-5rcv-m4m3-hfh7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Weakness
CWE-400, CWE-835
Updated
2026-11-02
OSVRHSA-2020:3369 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

Record
RHSA-2020:3369
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:3665 7.5

Red Hat Security Advisory: go-toolset:rhel8 security update

Record
RHSA-2020:3665
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4214 7.5

Red Hat Security Advisory: go-toolset-1.13-golang security and bug fix update

Record
RHSA-2020:4214
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4297 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update

Record
RHSA-2020:4297
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4694 7.5

Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Record
RHSA-2020:4694
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:5054 7.5

Red Hat Security Advisory: skopeo security update

Record
RHSA-2020:5054
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:5055 7.5

Red Hat Security Advisory: buildah security update

Record
RHSA-2020:5055
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:5056 7.5

Red Hat Security Advisory: podman security and bug fix update

Record
RHSA-2020:5056
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:5606 7.5

Red Hat Security Advisory: Red Hat OpenShift Container Storage 4.6 bug fix and enhancement update

Record
RHSA-2020:5606
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2020:4694 7.5

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749)

  • QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

  • golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Record
RLSA-2020:4694
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-14040 7.5

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Record
UBUNTU-CVE-2020-14040
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2020:4694 No score

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749)

  • QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

  • golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4694
Updated
2026-11-02
OSVGO-2020-0015 No score

Infinite loop when decoding some inputs in golang.org/x/text

An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to transform.String. If used to parse user supplied input, this may be used as a denial of service vector.

Record
GO-2020-0015
Updated
2026-11-02
OSVUSN-5873-1 No score

golang-golang-x-text, golang-x-text vulnerabilities

It was discovered that Go Text incorrectly handled certain encodings. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14040)

It was discovered that Go Text incorrectly handled certain BCP 47 language tags. An attacker could possibly use this issue to cause a denial of service. CVE-2020-28851, CVE-2020-28852 and CVE-2021-38561 affected only Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28851, CVE-2020-28852, CVE-2021-38561, CVE-2022-32149)

Record
USN-5873-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
golang.org/x/text
Go
 before 0.3.3
0.3.3
libslirp
AlmaLinux:8
 before 4.3.1-1.module_el8.6.0+2876+9ed4eae2
4.3.1-1.module_el8.6.0+2876+9ed4eae2
libslirp-devel
AlmaLinux:8
 before 4.3.1-1.module_el8.6.0+2876+9ed4eae2
4.3.1-1.module_el8.6.0+2876+9ed4eae2
python-podman-api
AlmaLinux:8
 before 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
python-podman-api
AlmaLinux:8
 before 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455
1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455
podman
Azure Linux:3
 before 5.6.1-2
5.6.1-2
buildah
Azure Linux:3
 before 1.41.4-2
1.41.4-2
golang-golang-x-text
Debian:12
 before 0.3.3-1
0.3.3-1
golang-golang-x-text
Debian:13
 before 0.3.3-1
0.3.3-1
golang-golang-x-text
Debian:14
 before 0.3.3-1
0.3.3-1
Show 133 moreShow less
Affected packages
PackageAffectedFixed
kiali
Red Hat:service_mesh:1.1::el7
 before 0:v1.12.10.redhat2-1.el7
0:v1.12.10.redhat2-1.el7
ior
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-citadel
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-cni
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-galley
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-grafana
Red Hat:service_mesh:1.1::el8
 before 0:6.4.3-13.el8
0:6.4.3-13.el8
servicemesh-grafana-prometheus
Red Hat:service_mesh:1.1::el8
 before 0:6.4.3-13.el8
0:6.4.3-13.el8
servicemesh-istioctl
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-mixc
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-mixs
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-operator
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-2.el8
0:1.1.6-2.el8
servicemesh-pilot-agent
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
servicemesh-prometheus
Red Hat:service_mesh:1.1::el8
 before 0:2.14.0-14.el8
0:2.14.0-14.el8
servicemesh-sidecar-injector
Red Hat:service_mesh:1.1::el8
 before 0:1.1.6-1.el8
0:1.1.6-1.el8
delve
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.2-3.module+el8.2.0+5581+896cb53e
0:1.3.2-3.module+el8.2.0+5581+896cb53e
delve-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.2-3.module+el8.2.0+5581+896cb53e
0:1.3.2-3.module+el8.2.0+5581+896cb53e
delve-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.2-3.module+el8.2.0+5581+896cb53e
0:1.3.2-3.module+el8.2.0+5581+896cb53e
go-toolset
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang-bin
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang-docs
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang-misc
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang-race
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang-src
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
golang-tests
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.15-1.module+el8.2.0+7662+fa98b974
0:1.13.15-1.module+el8.2.0+7662+fa98b974
go-toolset-1.13
Red Hat:devtools:2020
 before 0:1.13.15-1.el7
0:1.13.15-1.el7
go-toolset-1.13-build
Red Hat:devtools:2020
 before 0:1.13.15-1.el7
0:1.13.15-1.el7
go-toolset-1.13-golang
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-golang-bin
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-golang-docs
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-golang-misc
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-golang-race
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-golang-src
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-golang-tests
Red Hat:devtools:2020
 before 0:1.13.15-3.el7
0:1.13.15-3.el7
go-toolset-1.13-runtime
Red Hat:devtools:2020
 before 0:1.13.15-1.el7
0:1.13.15-1.el7
jenkins-2-plugins
Red Hat:openshift:4.6::el8
 before 0:4.6.1601368321-1.el8
0:4.6.1601368321-1.el8
openshift-clients
Red Hat:openshift:4.6::el7
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7
0:4.6.0-202010081244.p0.git.3794.4743d24.el7
openshift-clients-redistributable
Red Hat:openshift:4.6::el7
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7
0:4.6.0-202010081244.p0.git.3794.4743d24.el7
openshift-clients
Red Hat:openshift:4.6::el8
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8
0:4.6.0-202010081244.p0.git.3794.4743d24.el8
openshift-clients-redistributable
Red Hat:openshift:4.6::el8
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8
0:4.6.0-202010081244.p0.git.3794.4743d24.el8
containers-common
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
podman
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-debugsource
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-docker
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-remote
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-remote-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-tests
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
skopeo
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-debuginfo
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-debugsource
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-tests
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
runc
Red Hat:openshift:4.6::el7
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el7
0:1.0.0-81.rhaos4.6.git5b757d4.el7
runc-debuginfo
Red Hat:openshift:4.6::el7
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el7
0:1.0.0-81.rhaos4.6.git5b757d4.el7
runc
Red Hat:openshift:4.6::el8
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
runc-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
runc-debugsource
Red Hat:openshift:4.6::el8
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
buildah
Red Hat:enterprise_linux:8::appstream
 before 0:1.15.1-2.module+el8.3.0+8221+97165c3f
0:1.15.1-2.module+el8.3.0+8221+97165c3f
buildah-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.15.1-2.module+el8.3.0+8221+97165c3f
0:1.15.1-2.module+el8.3.0+8221+97165c3f
buildah-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.15.1-2.module+el8.3.0+8221+97165c3f
0:1.15.1-2.module+el8.3.0+8221+97165c3f
buildah-tests
Red Hat:enterprise_linux:8::appstream
 before 0:1.15.1-2.module+el8.3.0+8221+97165c3f
0:1.15.1-2.module+el8.3.0+8221+97165c3f
buildah-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.15.1-2.module+el8.3.0+8221+97165c3f
0:1.15.1-2.module+el8.3.0+8221+97165c3f
cockpit-podman
Red Hat:enterprise_linux:8::appstream
 before 0:18.1-2.module+el8.3.0+8221+97165c3f
0:18.1-2.module+el8.3.0+8221+97165c3f
conmon
Red Hat:enterprise_linux:8::appstream
 before 2:2.0.20-2.module+el8.3.0+8221+97165c3f
2:2.0.20-2.module+el8.3.0+8221+97165c3f
container-selinux
Red Hat:enterprise_linux:8::appstream
 before 2:2.144.0-1.module+el8.3.0+8221+97165c3f
2:2.144.0-1.module+el8.3.0+8221+97165c3f
containernetworking-plugins
Red Hat:enterprise_linux:8::appstream
 before 0:0.8.6-2.module+el8.3.0+8221+97165c3f
0:0.8.6-2.module+el8.3.0+8221+97165c3f
containernetworking-plugins-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.8.6-2.module+el8.3.0+8221+97165c3f
0:0.8.6-2.module+el8.3.0+8221+97165c3f
containernetworking-plugins-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.8.6-2.module+el8.3.0+8221+97165c3f
0:0.8.6-2.module+el8.3.0+8221+97165c3f
containers-common
Red Hat:enterprise_linux:8::appstream
 before 1:1.1.1-3.module+el8.3.0+8221+97165c3f
1:1.1.1-3.module+el8.3.0+8221+97165c3f
crit
Red Hat:enterprise_linux:8::appstream
 before 0:3.14-2.module+el8.3.0+8221+97165c3f
0:3.14-2.module+el8.3.0+8221+97165c3f
criu
Red Hat:enterprise_linux:8::appstream
 before 0:3.14-2.module+el8.3.0+8221+97165c3f
0:3.14-2.module+el8.3.0+8221+97165c3f
criu-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.14-2.module+el8.3.0+8221+97165c3f
0:3.14-2.module+el8.3.0+8221+97165c3f
criu-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.14-2.module+el8.3.0+8221+97165c3f
0:3.14-2.module+el8.3.0+8221+97165c3f
crun
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.1-2.module+el8.3.0+8221+97165c3f
0:0.14.1-2.module+el8.3.0+8221+97165c3f
crun-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.1-2.module+el8.3.0+8221+97165c3f
0:0.14.1-2.module+el8.3.0+8221+97165c3f
crun-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.14.1-2.module+el8.3.0+8221+97165c3f
0:0.14.1-2.module+el8.3.0+8221+97165c3f
fuse-overlayfs
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.2-3.module+el8.3.0+8221+97165c3f
0:1.1.2-3.module+el8.3.0+8221+97165c3f
fuse-overlayfs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.2-3.module+el8.3.0+8221+97165c3f
0:1.1.2-3.module+el8.3.0+8221+97165c3f
fuse-overlayfs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.2-3.module+el8.3.0+8221+97165c3f
0:1.1.2-3.module+el8.3.0+8221+97165c3f
libslirp
Red Hat:enterprise_linux:8::appstream
 before 0:4.3.1-1.module+el8.3.0+8221+97165c3f
0:4.3.1-1.module+el8.3.0+8221+97165c3f
libslirp-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:4.3.1-1.module+el8.3.0+8221+97165c3f
0:4.3.1-1.module+el8.3.0+8221+97165c3f
libslirp-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:4.3.1-1.module+el8.3.0+8221+97165c3f
0:4.3.1-1.module+el8.3.0+8221+97165c3f
libslirp-devel
Red Hat:enterprise_linux:8::appstream
 before 0:4.3.1-1.module+el8.3.0+8221+97165c3f
0:4.3.1-1.module+el8.3.0+8221+97165c3f
oci-seccomp-bpf-hook
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.2-3.module+el8.3.0+8221+97165c3f
0:1.1.2-3.module+el8.3.0+8221+97165c3f
oci-seccomp-bpf-hook-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.2-3.module+el8.3.0+8221+97165c3f
0:1.1.2-3.module+el8.3.0+8221+97165c3f
oci-seccomp-bpf-hook-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.2-3.module+el8.3.0+8221+97165c3f
0:1.1.2-3.module+el8.3.0+8221+97165c3f
podman
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-catatonit
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-catatonit-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-docker
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-remote
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-remote-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
podman-tests
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.5-5.module+el8.3.0+8221+97165c3f
0:2.0.5-5.module+el8.3.0+8221+97165c3f
python-podman-api
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.0-0.2.gitd0a45fe.module+el8.3.0+8221+97165c3f
0:1.2.0-0.2.gitd0a45fe.module+el8.3.0+8221+97165c3f
python3-criu
Red Hat:enterprise_linux:8::appstream
 before 0:3.14-2.module+el8.3.0+8221+97165c3f
0:3.14-2.module+el8.3.0+8221+97165c3f
runc
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
runc-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
runc-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
skopeo
Red Hat:enterprise_linux:8::appstream
 before 1:1.1.1-3.module+el8.3.0+8221+97165c3f
1:1.1.1-3.module+el8.3.0+8221+97165c3f
skopeo-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:1.1.1-3.module+el8.3.0+8221+97165c3f
1:1.1.1-3.module+el8.3.0+8221+97165c3f
skopeo-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:1.1.1-3.module+el8.3.0+8221+97165c3f
1:1.1.1-3.module+el8.3.0+8221+97165c3f
skopeo-tests
Red Hat:enterprise_linux:8::appstream
 before 1:1.1.1-3.module+el8.3.0+8221+97165c3f
1:1.1.1-3.module+el8.3.0+8221+97165c3f
slirp4netns
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.4-2.module+el8.3.0+8221+97165c3f
0:1.1.4-2.module+el8.3.0+8221+97165c3f
slirp4netns-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.4-2.module+el8.3.0+8221+97165c3f
0:1.1.4-2.module+el8.3.0+8221+97165c3f
slirp4netns-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.4-2.module+el8.3.0+8221+97165c3f
0:1.1.4-2.module+el8.3.0+8221+97165c3f
toolbox
Red Hat:enterprise_linux:8::appstream
 before 0:0.0.8-1.module+el8.3.0+8221+97165c3f
0:0.0.8-1.module+el8.3.0+8221+97165c3f
udica
Red Hat:enterprise_linux:8::appstream
 before 0:0.2.2-1.module+el8.3.0+8221+97165c3f
0:0.2.2-1.module+el8.3.0+8221+97165c3f
containers-common
Red Hat:rhel_extras_other:7
 before 1:0.1.40-12.el7_9
1:0.1.40-12.el7_9
skopeo
Red Hat:rhel_extras_other:7
 before 1:0.1.40-12.el7_9
1:0.1.40-12.el7_9
skopeo-debuginfo
Red Hat:rhel_extras_other:7
 before 1:0.1.40-12.el7_9
1:0.1.40-12.el7_9
buildah
Red Hat:rhel_extras_other:7
 before 0:1.11.6-12.el7_9
0:1.11.6-12.el7_9
buildah-debuginfo
Red Hat:rhel_extras_other:7
 before 0:1.11.6-12.el7_9
0:1.11.6-12.el7_9
podman
Red Hat:rhel_extras_other:7
 before 0:1.6.4-26.el7_9
0:1.6.4-26.el7_9
podman-debuginfo
Red Hat:rhel_extras_other:7
 before 0:1.6.4-26.el7_9
0:1.6.4-26.el7_9
podman-docker
Red Hat:rhel_extras_other:7
 before 0:1.6.4-26.el7_9
0:1.6.4-26.el7_9
mcg
Red Hat:openshift_container_storage:4.6::el8
 before 0:5.6.0-39.2279a46.5.6.el8
0:5.6.0-39.2279a46.5.6.el8
libslirp
Rocky Linux:8
 before 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1
0:4.3.1-1.module+el8.7.0+1076+9b1c11c1
libslirp
Rocky Linux:8
 before 0:4.3.1-1.module+el8.4.0+556+40122d08
0:4.3.1-1.module+el8.4.0+556+40122d08
libslirp
Rocky Linux:8
 before 0:4.3.1-1.module+el8.5.0+709+440d5e7e
0:4.3.1-1.module+el8.5.0+709+440d5e7e
libslirp
Rocky Linux:8
 before 0:4.3.1-1.module+el8.6.0+783+10209741
0:4.3.1-1.module+el8.6.0+783+10209741
python-podman-api
Rocky Linux:8
 before 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
python-podman-api
Rocky Linux:8
 before 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2
0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2
python-podman-api
Rocky Linux:8
 before 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d
0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d
toolbox
Rocky Linux:8
 before 0:0.0.8-1.module+el8.4.0+556+40122d08
0:0.0.8-1.module+el8.4.0+556+40122d08
golang-x-text
Ubuntu:16.04:LTS
 All versions, plus listed versions
0+git20151019.0fe7e68-0ubuntu10+git20151217.cf49866-0ubuntu1
 None known
golang-x-text
Ubuntu:18.04:LTS
 before 0.0~git20170627.0.6353ef0-1ubuntu2.1, plus listed versions
0.0~git20170627.0.6353ef0-1ubuntu10.0~git20170627.0.6353ef0-1ubuntu2
0.0~git20170627.0.6353ef0-1ubuntu2.1
golang-golang-x-text
Ubuntu:20.04:LTS
 before 0.3.2-4ubuntu0.1, plus listed versions
0.3.2-30.3.2-4
0.3.2-4ubuntu0.1
golang-x-text
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.3.2-1
 None known
golang-golang-x-text
Ubuntu:22.04:LTS
 before 0.3.7-1ubuntu0.20.04.1, plus listed versions
0.3.6-10.3.7-1
0.3.7-1ubuntu0.20.04.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-14040 is a high vulnerability (CVSS 7.5) in Golang Text, published June 17, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in golang.org/x/text 0.3.3.

References

Show 172 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open