CVE-2020-29510

MEDIUM5.6EPSS 0.12%

Published: 12/14/2020Modified: 4/28/2026

Also known as:DEBIAN-CVE-2020-29510

Description

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Affected packages (2)

Bitnami/golangfrom 0, < 1.15.1
Debian/golang-1.15from 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References (4)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-29510
WEBhttps://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2020-29510
WEBhttps://security.netapp.com/advisory/ntap-20210129-0006/