CVE-2020-25614
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
CVE-2020-25614- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
CVE List No score
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
CVE-2020-25614- Updated
- 2026-11-02
EUVDEUVD-2022-7060 No score
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
EUVD-2022-7060- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-93m7-c69f-5cfj
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
GHSA-93m7-c69f-5cfj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
OSV
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
CVE-2020-25614- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-25614
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
DEBIAN-CVE-2020-25614- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-93m7-c69f-5cfj
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
GHSA-93m7-c69f-5cfj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119, CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-25614
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
- Record
UBUNTU-CVE-2020-25614- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGO-2020-0048 No score
Denial of service in github.com/antchfx/xmlquery
LoadURL does not check the Content-Type of loaded resources, which can cause a panic due to nil pointer deference if the loaded resource is not XML. If user supplied URLs are loaded, this may be used as a denial of service vector.
- Record
GO-2020-0048- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/antchfx/xmlqueryGo |
before 1.3.1 | 1.3.1 |
golang-github-antchfx-xmlqueryDebian:12 |
before 1.3.3-1 | 1.3.3-1 |
golang-github-antchfx-xmlqueryDebian:13 |
before 1.3.3-1 | 1.3.3-1 |
golang-github-antchfx-xmlqueryDebian:14 |
before 1.3.3-1 | 1.3.3-1 |
golang-github-antchfx-xmlqueryUbuntu:20.04:LTS |
All versions, plus listed versions 1.2.1-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25614 is a critical vulnerability (CVSS 9.8) in Xmlquery Project Xmlquery, published September 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in github.com/antchfx/xmlquery 1.3.1.