PT-2022-16983 · Go+5 · Go+5
Juho Nurminen
·
Published
2022-03-03
·
Updated
2025-02-14
·
CVE-2022-24921
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.16.15
Go versions 1.17.x prior to 1.17.8
Description
The issue allows for stack exhaustion via a deeply nested expression in the
regexp.Compile function. This can be triggered by an extremely deeply nested expression, typically on the order of 2MB, causing the program to exit due to goroutine stack exhaustion. This issue is particularly relevant on 64-bit platforms.Recommendations
For Go versions prior to 1.16.15, update to version 1.16.15 or later.
For Go versions 1.17.x prior to 1.17.8, update to version 1.17.8 or later.
As a temporary workaround, consider restricting the use of deeply nested expressions in the
regexp.Compile function to minimize the risk of exploitation.Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Go
Red Hat
Rocky Linux
Suse