Fluid Attacks Database

Description

Stack exhaustion when compiling deeply nested expressions in regexp On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	stdlib	>=0 <1.16.15	1.16.15
debian 11	golang-1.15	=1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.9-6 \|\| >=0 <1.15.15-1~deb11u4	1.15.15-1~deb11u4
rpm rhel9	golang	<0:1.17.12-1.el9_0	0:1.17.12-1.el9_0
rpm rhel7	golang	-	-
rpm rhel8	go-toolset	<0:1.17.10-1.module+el8.6.0+15486+6d4da7db	0:1.17.10-1.module+el8.6.0+15486+6d4da7db
rpm rhel9	go-toolset	<0:1.17.12-1.el9_0	0:1.17.12-1.el9_0

Aliases

1. CVE-2022-249212. NVD-2022-249213. OSV-GO-2021-03474. OSV-2022-249215. OSV-DEBIAN-2022-249216. GCVE-2022-249217. SECURITY-TRACKER-CVE-2022-24921

References

1. https://go.dev/cl/3846162. https://go.googlesource.com/go/+/452f24ae94f38afa3704d4361d91d51218405c0a3. https://go.dev/issue/511124. https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.