Every CVE Search/ Get API key

CVE-2020-29245

dhowden tag panic due to out-of-bounds read

6.5 MediumFix available

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.10%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.

Record
CVE-2020-29245
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-129
Updated
2026-11-02
CVE List No score

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.

Record
CVE-2020-29245
Updated
2026-11-02
EUVDEUVD-2022-5571 No score

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.

Record
EUVD-2022-5571
Updated
2026-11-03
GitHub AdvisoriesGHSA-wg79-2cgp-qrjm 6.5

dhowden tag panic due to out-of-bounds read

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAtomData due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.

Record
GHSA-wg79-2cgp-qrjm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSVGHSA-27mh-3343-6hg5 6.5

dhowden tag panic due to out-of-bounds read

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.

Record
GHSA-27mh-3343-6hg5
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSVGHSA-9wm7-rc47-g56m 6.5

dhowden tag panic due to out-of-bounds read

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAPICFrame due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.

Record
GHSA-9wm7-rc47-g56m
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSVGHSA-9xm8-8qvc-vw3p 5.3

Denial of Service in dhowden/tag

dhowden tag before 0.0.0-20201120070457-d52dcb253c63 allows panic: runtime error: index out of range via readPICFrame.

Record
GHSA-9xm8-8qvc-vw3p
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Weakness
CWE-129
Updated
2026-11-02
OSVGHSA-wg79-2cgp-qrjm 6.5

dhowden tag panic due to out-of-bounds read

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAtomData due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.

Record
GHSA-wg79-2cgp-qrjm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSVGO-2021-0097 No score

Panic due to out-of-bounds read in github.com/dhowden/tag

Due to improper bounds checking, a number of methods can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.

Record
GO-2021-0097
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/dhowden/tag
Go
before 0.0.0-20201120070457-d52dcb253c63
0.0.0-20201120070457-d52dcb253c63
github.com/dhowden/tag
Go
From an advisory covering 4 CVEs
before 0.0.0-20201120070457-d52dcb253c63
0.0.0-20201120070457-d52dcb253c63

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-29245 is a medium vulnerability (CVSS 6.5) in Tag Project Tag, published December 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in github.com/dhowden/tag 0.0.0-20201120070457-d52dcb253c63.

References

Show 9 moreShow less
MoveEnter Open