An infinite loop vulnerability in golang.org/x/text/unicode/norm affects version 0 up to (excluding) 0.39.0, creating a high-severity risk of denial of service.

This flaw is an infinite loop (CWE-835) triggered when the norm.Iter function handles invalid UTF-8 bytes, requiring unauthenticated network access with no user interaction.

A successful exploit causes application hangs or crashes, leading to severe denial of service and system downtime for applications processing untrusted text input. The CVSS score of 7.5 reflects high availability impact that can disrupt critical business operations without requiring any user interaction or privileges.

Immediate Action: Update golang.org/x/text to version 0.39.0 or later to resolve the infinite loop flaw.

Proactive Monitoring: Monitor application resource utilization such as CPU spikes and hanging worker threads when parsing external data streams.

Compensating Controls: Implement strict input validation and sanitization at application boundaries to block malformed UTF-8 byte sequences before they reach the text normalization library.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the high severity and potential for unauthenticated denial of service attacks, engineering teams must prioritize updating the golang.org/x/text dependency. Apply the latest version immediately to ensure service stability and prevent application resource exhaustion.