{"id":"CVE-2020-14040","title":"golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)","summary":"A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vuln…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-835","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.6","affected":["openshift_developer_tools_and_services","openshift_service_mesh 1","advanced_cluster_management_for_kubernetes 2","ceph_storage 2","ceph_storage 3","ceph_storage 4","enterprise_linux 7","enterprise_linux 8","openshift_container_platform 3.11","openshift_container_platform 4","openshift_virtualization 1","openshift_virtualization 2","storage 3","service_telemetry_framework_1_2_for_rhel 8","service_telemetry_framework_1_3_for_rhel 8","developer_tools_for_red_hat_enterprise_linux_server_v_7","enterprise_linux_7_extras","3scale_amp 2.10","openshift_jaeger 1.17","openshift_container_platform 4.4","openshift_container_platform 4.5","openshift_service_mesh 1.1","developer_tools_for_red_hat_enterprise_linux_workstation_v_7","openshift_jaeger 1.20","openshift_service_mesh 1.0","openshift_serverless 1.11","quay v3","openshift_container_storage_4_6_on_rhel_8","advanced_cluster_management_for_kubernetes_2_1_for_rhel 8","openshift_container_platform 4.6","openshift_container_platform 4.7","enterprise_linux_appstream_v_8","fuse 7.9","integration"],"patched":["developer_tools_for_red_hat_enterprise_linux_server_v_7","enterprise_linux_7_extras","3scale_amp 2.10","openshift_jaeger 1.17","openshift_container_platform 3.11","openshift_container_platform 4.4","openshift_container_platform 4.5","openshift_service_mesh 1.1","developer_tools_for_red_hat_enterprise_linux_workstation_v_7","openshift_jaeger 1.20","openshift_service_mesh 1.0","openshift_serverless 1.11","quay v3","openshift_container_storage_4_6_on_rhel_8","advanced_cluster_management_for_kubernetes_2_1_for_rhel 8","openshift_container_platform 4.6","openshift_container_platform 4.7","enterprise_linux_appstream_v_8","fuse 7.9","integration"],"published":"2020-06-17","updated":"2026-09-16","sourceUpdated":"2026-09-16T23:29:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-14040.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-14040.json"},{"url":"https://access.redhat.com/security/cve/CVE-2020-14040"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1853652"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14040"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14040"},{"url":"https://github.com/golang/go/issues/39491"},{"url":"https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0"},{"url":"https://access.redhat.com/errata/RHSA-2020:4214"},{"url":"https://access.redhat.com/errata/RHSA-2020:5055"},{"url":"https://access.redhat.com/errata/RHSA-2020:5054"},{"url":"https://access.redhat.com/errata/RHSA-2020:5056"},{"url":"https://access.redhat.com/errata/RHSA-2021:1129"},{"url":"https://access.redhat.com/errata/RHSA-2020:3087"},{"url":"https://access.redhat.com/errata/RHSA-2020:3727"},{"url":"https://access.redhat.com/errata/RHSA-2020:3783"},{"url":"https://access.redhat.com/errata/RHSA-2020:3578"},{"url":"https://access.redhat.com/errata/RHSA-2020:3780"},{"url":"https://access.redhat.com/errata/RHSA-2020:3369"},{"url":"https://access.redhat.com/errata/RHSA-2020:5198"},{"url":"https://access.redhat.com/errata/RHSA-2020:3372"},{"url":"https://access.redhat.com/errata/RHSA-2020:5149"},{"url":"https://access.redhat.com/errata/RHSA-2021:0420"},{"url":"https://access.redhat.com/errata/RHSA-2020:5606"},{"url":"https://access.redhat.com/errata/RHSA-2020:5605"},{"url":"https://access.redhat.com/errata/RHSA-2021:0980"},{"url":"https://access.redhat.com/errata/RHSA-2021:1369"},{"url":"https://access.redhat.com/errata/RHSA-2020:4297"},{"url":"https://access.redhat.com/errata/RHSA-2020:4298"},{"url":"https://access.redhat.com/errata/RHSA-2020:5633"},{"url":"https://access.redhat.com/errata/RHSA-2020:5635"},{"url":"https://github.com/golang/text/commit/23ae387dee1f90d29a23c0e87ee0b46038fbed0e"},{"url":"https://go-review.googlesource.com/c/text/+/238238"},{"url":"https://go.dev/cl/238238"},{"url":"https://go.dev/issue/39491"},{"url":"https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e"},{"url":"https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.0184,"epssPercentile":0.78043,"aliases":["GHSA-5rcv-m4m3-hfh7","GO-2020-0015"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.756Z","slug":"CVE-2020-14040","body":"## Overview\n\nA denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific characters or strings to the vulnerable application, there is the potential to cause an infinite loop to occur using more memory, resulting in a denial of service.\n\n## Vendor advisories\n\n- **RHSA-2020:4214** · Red Hat · fixed in: Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7), Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) · released 2020-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2020:4214)\n- **RHSA-2020:5055** · Red Hat · fixed in: Red Hat Enterprise Linux 7 Extras · released 2020-11-10 · [advisory](https://access.redhat.com/errata/RHSA-2020:5055)\n- **RHSA-2020:5054** · Red Hat · fixed in: Red Hat Enterprise Linux 7 Extras · released 2020-11-10 · [advisory](https://access.redhat.com/errata/RHSA-2020:5054)\n- **RHSA-2020:5056** · Red Hat · fixed in: Red Hat Enterprise Linux 7 Extras · released 2020-11-10 · [advisory](https://access.redhat.com/errata/RHSA-2020:5056)\n- **RHSA-2021:1129** · Red Hat · fixed in: Red Hat 3Scale AMP 2.10 · released 2021-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2021:1129)\n- **RHSA-2020:3087** · Red Hat · fixed in: Red Hat OpenShift Jaeger 1.17 · released 2020-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2020:3087)\n- **RHSA-2020:3727** · Red Hat · fixed in: Red Hat OpenShift Container Platform 3.11 · released 2020-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2020:3727)\n- **RHSA-2020:3783** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.4 · released 2020-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2020:3783)\n- **RHSA-2020:3578** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.5 · released 2020-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2020:3578)\n- **RHSA-2020:3780** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.5 · released 2020-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2020:3780)\n- **RHSA-2020:3369** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 1.1, OpenShift Service Mesh 1.1 · released 2020-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2020:3369)\n- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services, OpenShift Service Mesh 1, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 2, Red Hat Ceph Storage 3, Red Hat Ceph Storage 4, … · no fix planned: OpenShift Developer Tools and Services, OpenShift Service Mesh 1, Red Hat Ceph Storage 2, Red Hat Enterprise Linux 7, … · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-14040.json)\n\n**golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash** — rated Moderate by Red Hat. Released 2020-06-17, updated 2026-09-16.\n\nAffected:\n\n- OpenShift Developer Tools and Services\n- OpenShift Service Mesh 1\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Ceph Storage 2\n- Red Hat Ceph Storage 3\n- Red Hat Ceph Storage 4\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Virtualization 1\n- Red Hat OpenShift Virtualization 2\n- Red Hat Storage 3\n- Service Telemetry Framework 1.2 for RHEL 8\n- Service Telemetry Framework 1.3 for RHEL 8\n\nFixed:\n\n- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)\n- Red Hat Enterprise Linux 7 Extras\n- Red Hat 3Scale AMP 2.10\n- Red Hat OpenShift Jaeger 1.17\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4.4\n- Red Hat OpenShift Container Platform 4.5\n- Red Hat OpenShift Service Mesh 1.1\n- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)\n- Red Hat OpenShift Jaeger 1.20\n- OpenShift Service Mesh 1.0\n- OpenShift Service Mesh 1.1\n- Openshift Serverless 1.11\n- Quay v3\n- Red Hat OpenShift Container Storage 4.6 on RHEL-8\n- Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8\n- Red Hat OpenShift Container Platform 4.6\n- Red Hat OpenShift Container Platform 4.7\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Fuse 7.9\n- Red Hat Integration\n\nNo fix planned:\n\n- OpenShift Developer Tools and Services\n- OpenShift Service Mesh 1\n- Red Hat Ceph Storage 2\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Virtualization 1\n- Red Hat Ceph Storage 3\n- Red Hat Ceph Storage 4\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat Storage 3\n- Service Telemetry Framework 1.2 for RHEL 8\n- Service Telemetry Framework 1.3 for RHEL 8\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Virtualization 2\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4.5\n- Red Hat OpenShift Container Platform 4.6\n- Red Hat OpenShift Jaeger 1.20\n- Red Hat OpenShift Container Storage 4.6 on RHEL-8\n- Red Hat OpenShift Container Platform 4.7\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2020:4214\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2020:5055\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2020:5054\n\n## Package advisory (CVE-2020-14040)\n\nAffected packages:\n\n- `golang.org/x/text < 0.3.3`\n\nPatched in:\n\n- `golang.org/x/text 0.3.3`\n\nSource: https://osv.dev/vulnerability/GHSA-5rcv-m4m3-hfh7","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}