CVE-2020-28851: 
Go vulnerability analysis and mitigation

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. The vulnerability, identified as CVE-2020-28851, was discovered in late 2020 and affects the x/text/language component, which is supposed to be able to parse HTTP Accept-Language headers (NVD, GitHub Issue).

The vulnerability manifests as an "index out of range" panic in the language.ParseAcceptLanguage function specifically when processing the -u- extension in language tags. The issue received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a high severity issue with network accessibility and no required privileges or user interaction (NetApp Advisory).

The vulnerability can lead to a Denial of Service (DoS) condition when successfully exploited. The impact is primarily on availability, with no direct effect on confidentiality or integrity of the system (NetApp Advisory).

The vulnerability is remotely exploitable and requires no special privileges or user interaction. The issue can be triggered through malformed Accept-Language headers, making it particularly concerning for web applications that process language tags (NVD).

The issue was identified and reported through the Go issue tracking system. Updates to the x/text package were released to address this vulnerability. Users are advised to update to patched versions of the software (GitHub Issue).