MEDIUM 5.6 Microsoft

CVE-2020-29511

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Microsoft Security Update 2026-Aug: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

Affected Products

References

Published: 2026-08-06 · Source: Microsoft · Feed updated: 2026-08-10
This medium severity vulnerability with a CVSS score of 5.6 was published on 2026-08-06 via Microsoft. Affected: azl3 golang 1.24.3-1 on Azure Linux 3.0, cm1 golang 1.17.13-2 on CBL Mariner 1.0, cbl2 golang 1.20.10-1 on CBL Mariner 2.0 and 1 more.
vulnfeed aggregates 8893 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.