Skip to content

Invalid v3.1 vector is parsed with no error #1

@pandatix

Description

@pandatix

Hey folks !
While running differential fuzzing with existing Go implementations of CVSS I discovered a bug in your implementation of 3.1 parsing.

I used reference v0.0.0-20250717011716-41efc8551f0f which corresponds to commit 41efc8551f0f.

Let's consider the following code.

vector := "CVSS:0.0/S:C"
_, err := scagogogoparser.NewCvss3xParser(vector).Parse()
if err == nil {
	fmt.Println("there should be an error")
}

When running, the err is nil despite the vector being invalid.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions