A norm.Iter in golang.org/x/text can become trapped in an endless loop when processing input that contains invalid UTF‑8 bytes. This reflects deficiencies in the library's handling of invalid input, corresponding to CWE‑835 (Infinite Loop). The infinite loop consumes CPU cycles and can tie up a process, effectively denying service until the process is terminated or the system is rebooted. No escalation to remote code execution or data exfiltration is described.

The vulnerability affects the Unicode normalization component (golang.org/x/text/unicode/norm) of the Go text library. No specific version information is available in the advisory.

With a CVSS score of 7.5, this vulnerability is classified as high severity. The EPSS score indicates that the likelihood of exploitation is very low (<1 %). The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted input to a consumer of the norm.Iter routine. If the consuming application accepts user data that is not validated for proper UTF‑8, the infinite loop could be triggered, leading to a denial‑of‑service condition.