Unexpected security footguns in Go

Summary: Trail of Bits reports that Go's JSON, XML, and YAML parsers have unexpected behaviors it has repeatedly exploited during security assessments to bypass authentication, circumvent authorization, and exfiltrate data, citing CVE-2020-16250, a HashiCorp Vault authentication bypass found by Google's Project Zero. The post details three attack scenarios, including a parser-differential attack where Go's JSON parser takes the last duplicate key and matches field names case-insensitively, so an authorization service and a proxy service can disagree on what action a request contains.
Why it matters: Go's JSON parser matches field names case-insensitively and takes the last duplicate key with no way to disable either behavior, so any architecture where one service checks permissions and another acts on the same input can be made to see two different requests. The Vault bypass behind CVE-2020-16250 came from feeding a JSON document to Go's lenient XML parser, which was enough for full authentication bypass.

Read the original at Trail of Bits Blog ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2020-16250
Related: Enter the Vault: Authentication Issues in Hashi Corp Vault Cyber Risks ·
New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026
New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026