X/Text · X/Text · CVE-2020-28852
Name of the Vulnerable Software and Affected Versions:
x/text versions prior to 0.3.5
x/text version 1.15.4
Description:
A "slice bounds out of range" panic occurs in `language.ParseAcceptLanguage` while processing a BCP 47 tag. The `x/text/language` package is supposed to be able to parse an HTTP Accept-Language header.
Recommendations:
For versions prior to 0.3.5, update to version 0.3.5 or later.
For version 1.15.4, update to a version later than 1.15.4.
As a temporary workaround, consider disabling the `language.ParseAcceptLanguage` function until a patch is available.