CVE-2020-29510
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the...
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
CVE-2020-29510- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-115
- Updated
- 2026-11-02
EUVDEUVD-2020-21877
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
EUVD-2020-21877- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6mv-vmpw-j23r No score
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the...
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
GHSA-p6mv-vmpw-j23r- Updated
- 2026-11-02
NVD
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
CVE-2020-29510- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-115
- Updated
- 2026-11-02
OSV
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
CVE-2020-29510- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-29510
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
DEBIAN-CVE-2020-29510- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-29510
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
UBUNTU-CVE-2020-29510- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVBIT-golang-2020-29510 No score
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
- Record
BIT-golang-2020-29510- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golangBitnami |
before 1.15.1 | 1.15.1 |
golang-1.15Debian:11 |
All versions, plus listed versions 1.15.15-11.15.15-1~deb11u11.15.15-1~deb11u21.15.15-1~deb11u31.15.15-1~deb11u4 Show 5 moreShow less1.15.15-21.15.15-31.15.15-41.15.15-51.15.9-6 |
None known |
golang-1.10Ubuntu:14.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~14.04.1 |
None known |
golang-1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2 |
None known |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
golang-1.13Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3 |
None known |
golang-1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2 |
None known |
golang-1.13Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1 |
None known |
golang-1.8Ubuntu:18.04:LTS |
All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 |
None known |
golang-1.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 |
None known |
golang-1.13Ubuntu:20.04:LTS |
All versions, plus listed versions 1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1 Show 5 moreShow less1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2 |
None known |
golang-1.14Ubuntu:20.04:LTS |
All versions, plus listed versions 1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1 Show 4 moreShow less1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2 |
None known |
golang-1.13Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-29510 is a critical vulnerability (CVSS 9.8) in Ecies Go, published December 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in golang 1.15.1.
References
github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
security.netapp.com/advisory/ntap-20210129-0006
nvd.nist.gov/vuln/detail/CVE-2020-29510
security-tracker.debian.org/tracker/CVE-2020-29510
ubuntu.com/security/CVE-2020-29510
mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
cve.org/CVERecord?id=CVE-2020-29510