-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from ParseAcceptLanguage's handling of input with many dashes, which triggers quadratic parsing complexity. The commit patching CVE-2022-32149 specifically adds a dash count check to this function in parse.go, confirming it was the entry point for malicious payloads. The CVE description explicitly mentions ParseAcceptLanguage as the attack vector, and the patch modifies only this function to add security constraints.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/text | go | < 0.3.8 | 0.3.8 |