CVE-2026-107214: Go Crypto Cbc Decrypter Without Length Validationcve-2026-107214-go-crypto-cbc-decrypter-without-length-validation
CBC decryption via cipher.NewCBCDecrypter(...).CryptBlocks(...) is performed without checking that the initialization vector length equals the cipher block size and that the ciphertext length is a multiple of the block size. Go's crypto/cipher panics on either violation ("IV length must equal block size" / "input not full blocks"), so attacker-controlled doc
