CVE-2020-29245
dhowden tag panic due to out-of-bounds read
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
- Record
CVE-2020-29245- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-129
- Updated
- 2026-11-02
CVE List No score
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
- Record
CVE-2020-29245- Updated
- 2026-11-02
EUVDEUVD-2022-5571 No score
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
- Record
EUVD-2022-5571- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wg79-2cgp-qrjm
6.5
dhowden tag panic due to out-of-bounds read
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAtomData due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
- Record
GHSA-wg79-2cgp-qrjm- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVGHSA-27mh-3343-6hg5
6.5
dhowden tag panic due to out-of-bounds read
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
- Record
GHSA-27mh-3343-6hg5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVGHSA-9wm7-rc47-g56m
6.5
dhowden tag panic due to out-of-bounds read
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAPICFrame due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
- Record
GHSA-9wm7-rc47-g56m- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVGHSA-9xm8-8qvc-vw3p
5.3
Denial of Service in dhowden/tag
dhowden tag before 0.0.0-20201120070457-d52dcb253c63 allows panic: runtime error: index out of range via readPICFrame.
- Record
GHSA-9xm8-8qvc-vw3p- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVGHSA-wg79-2cgp-qrjm
6.5
dhowden tag panic due to out-of-bounds read
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAtomData due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
- Record
GHSA-wg79-2cgp-qrjm- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVGO-2021-0097 No score
Panic due to out-of-bounds read in github.com/dhowden/tag
Due to improper bounds checking, a number of methods can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
- Record
GO-2021-0097- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/dhowden/tagGo |
before 0.0.0-20201120070457-d52dcb253c63 | 0.0.0-20201120070457-d52dcb253c63 |
github.com/dhowden/tagGo From an advisory covering 4 CVEs |
before 0.0.0-20201120070457-d52dcb253c63 | 0.0.0-20201120070457-d52dcb253c63 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-29245 is a medium vulnerability (CVSS 6.5) in Tag Project Tag, published December 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in github.com/dhowden/tag 0.0.0-20201120070457-d52dcb253c63.
References
github.com/dhowden/tag/issues/78
nvd.nist.gov/vuln/detail/CVE-2020-29245
github.com/dhowden/tag/commit/4b595ed4fac79f467594aa92f8953f90f817116e
github.com/dhowden/tag/commit/6b18201aa5c5535511802ddfb4e4117686b4866d
github.com/dhowden/tag/commit/a92213460e4838490ce3066ef11dc823cdc1740e
github.com/dhowden/tag/commit/d52dcb253c63a153632bfee5f269dd411dcd8e96
Show 9 moreShow less
pkg.go.dev/vuln/GO-2021-0097
github.com/advisories/GHSA-wg79-2cgp-qrjm
nvd.nist.gov/vuln/detail/CVE-2020-29244
github.com/dhowden/tag/issues/79
github.com/dhowden/tag
nvd.nist.gov/vuln/detail/CVE-2020-29243
github.com/dhowden/tag/issues/80
nvd.nist.gov/vuln/detail/CVE-2020-29242
github.com/dhowden/tag/issues/77