CVE-2022-32149High· 7.5▾ Twilightgolang.org/x/text/language Denial of service via crafted Accept-Language header
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.6%
1.6% → 1.6%
The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.
golang.org/x/text/language
golang.org/x/text < 0.3.8Upgrade to a patched release:
golang.org/x/text 0.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2025-22868High· 7.5golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
CVE-2022-27664High· 7.5golang.org/x/net/http2 Denial of Service vulnerability
CVE-2026-25680Medium· 6.5Go Net HTML parser is vulnerable to denial of service
CVE-2018-17847High· 7.5golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-33809Medium· 5.3Go Images vulnerable to an out-of-memory error via a crafted TIFF file
CVE-2020-29652High· 7.5golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability