CVE-2021-38561

Vulnerability

The vulnerability resides in the golang.org/x/text/language package, which implements BCP 47 language tag parsing and matching [1]. Due to a mishandled index calculation during parsing, an attacker can trigger an out-of-bounds read, causing the program to panic [3]. This affects versions before 0.3.7.

Exploitation

The attack surface is any application that parses untrusted language tags, such as those from HTTP Accept-Language headers, cookies, or user-supplied input [1]. No authentication is required; the attacker only needs to send a crafted BCP 47 tag to a vulnerable endpoint. The parsing function does not properly validate index boundaries, leading to a panic when processing malformed input.

Impact

Successful exploitation results in a denial-of-service (DoS) condition: the application crashes due to the panic. This can be used to disrupt services that rely on language tag parsing, such as content negotiation or localization systems.

Mitigation

The issue is fixed in version 0.3.7 of golang.org/x/text [4]. Users should update to this version or later. No workaround is available; upgrading is the recommended action.