A Stack-Overflow Denial of Service in Google's OSV-Scanner
OSV-Scanner reads the licence text of every package it scans, and it parsed that text with a recursive descent that had no depth limit. Roughly three megabytes of open brackets exhausted the goroutine stack. In Go a stack overflow is a fatal error rather than a panic, so recover cannot catch it and one malformed package ended the entire scan. This is the report, the forty lines that fixed it, and what contributing upstream to Google actually involved.