The Nickname profile in golang.org/x/text/secure/precis contains an out-of-bounds slice error that triggers a panic when a crafted input is processed into a short destination buffer. This panic immediately terminates the calling goroutine and can bring down the entire application or service that relies on the library. Because the flaw does not enable arbitrary code execution or persistent data tampering, the primary damage is availability loss to users who depend on the affected functionality.

Any software that imports golang.org/x/text and calls the Nickname profile function is at risk. The fix is available in updated releases of golang.org/x/text, yet the version range for vulnerability is not explicitly stated, so deployments using the current unpatched implementation should be considered vulnerable until a patched version is installed.

The CVSS score of 7.5 signifies a high potential impact on availability. The EPSS score of less than 1% (approximately 0.155%) indicates that the probability of exploitation in the wild is very low. The vulnerability requires an attacker to supply carefully crafted input to the Nickname profile function; no privileged access is needed. Therefore, although a successful exploitation would cause a denial of service, the overall risk is moderate because the likelihood of exploitation is scarce and the vulnerability is not currently listed in CISA’s KEV catalog.