PT-2022-4638 · Go+9 · Compress/Gzip+9
Tatianabo
·
Published
2022-07-12
·
Updated
2025-10-20
·
CVE-2022-30631
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
compress/gzip versions prior to 1.17.12
compress/gzip versions prior to 1.18.4
Description
The issue is related to uncontrolled recursion in the Reader.Read function of the compress/gzip package in the Go programming language. This can be exploited by a remote attacker to cause a denial of service by providing an archive containing a large number of concatenated 0-length compressed files, leading to stack exhaustion and a panic.
Recommendations
For versions prior to 1.17.12, update to version 1.17.12 or later to resolve the issue.
For versions prior to 1.18.4, update to version 1.18.4 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the Reader.Read function on archives containing concatenated 0-length compressed files to minimize the risk of exploitation.
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Compress/Gzip