UNEXPECTED SECURITY FOOTGUNS IN GO'S PARSERS

Summary from the TLDR InfoSec newsletter

Go's parsers for JSON, XML, and YAML have risky default behaviors such as case-insensitive fields, duplicate key acceptance, and lenient garbage data handling, which attackers can exploit to bypass security. These differences lead to conflicting interpretations across services processing the same input, causing vulnerabilities like CVE-2020-16250 in HashiCorp Vault. The new JSON v2 spec aims to fix these with secure defaults, but current measures rely on custom validation and static analysis.