The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.15 (including) |