---
cve: "CVE-2021-27918"
severity: "LOW"
cvss: 3.1
epss: "2.5%"
vendor: "n/a"
kev: false
exploited: false
published: "2021-03-11 00:15:12"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-11T13:02:55+02:00"
---

# CVE-2021-27918

> 3.1 LOW

## Beschreibung

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

## Patch verfügbar (OSV)

- 13722418773b6a081816e8cc48131306565db1bd (Commit)
- e9e0473681e581040b4adcd64b53967e1572fe8d (Commit)

## Referenzen

- <https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw>
- <https://security.gentoo.org/glsa/202208-02>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2021-27918) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_