---
id: 1389
title: "[CVE-2020-16250] Unexpected security footguns in Go's parsers"
cve: CVE-2020-16250
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/"
published_at: "2025-06-18 11:00"
tags: ["authentication-bypass", "deserialization", "go", "json", "xml", "yaml", "parsers", "cve-2020-16250"]
phying_url: "https://phying.com/item/1389"
lang: en
---

# [CVE-2020-16250] Unexpected security footguns in Go's parsers

## Summary

Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **CVE:** CVE-2020-16250
- **Published:** 2025-06-18 11:00
- **Original:** https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/
- **Phying News:** https://phying.com/item/1389