CVE-2020-29511: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

CSIRTS triage

vendor: Go product: GoOtheraffected: all versions

What: XML encoding package does not preserve element namespace prefix semantics during tokenization round-trips.
Who is affected: Go applications using encoding/xml package.
Urgency: Medium priority; CVSS 5.6, inconsistent processing in downstream code.
Action: Update Go language to patched version and review namespace handling in applications.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Go

Get an email when a new Go advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2020-295111.9% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 78% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2020-29511	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.