CVE-2020-36568: Resource exhaustion in github.com/revel/revel

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-27 · updated 2026-06-17
Weakness: CWE-770

Description

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.

Affected products

github.com/revel/revel: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: github.com/revel/revel 1.0.0. Check the vendor advisory for mitigations.

References

https://github.com/revel/revel/commit/d160ecb72207824005b19778594cbdc272e8a605
https://github.com/revel/revel/issues/1424
https://github.com/revel/revel/pull/1427
https://pkg.go.dev/vuln/GO-2020-0003
https://github.com/revel/revel/commit/d160ecb72207824005b19778594cbdc272e8a605
https://github.com/revel/revel/issues/1424
https://github.com/revel/revel/pull/1427
https://pkg.go.dev/vuln/GO-2020-0003

Get alerted when CVE-2020-36568 or the next vulnerability affects your stack