CVE-2020-14040

CVE-2020-14040 is a denial-of-service vulnerability affecting the x/text package (before 0.3.3) for Go, specifically within its encoding/unicode component. An attacker can trigger an infinite loop in the UTF-16 decoder by providing a single byte to a specially configured decoder, leading to program crashes or out-of-memory errors in affected Go applications and Fedora distributions. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, requiring no user interaction. The primary impact is high availability loss, as it can render affected systems unusable. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has garnered minimal community discussion and media coverage.