Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2022-30633

Stack exhaustion when unmarshaling certain documents in encoding/xml

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 11 more
CVE-2022-32148

Exposure of client IP addresses in net/http

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 16 more
CVE-2022-1962

Stack exhaustion due to deeply nested types in go/parser

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 13 more
CVE-2022-30630

Stack exhaustion in Glob on certain paths in io/fs

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 14 more
CVE-2022-1705

Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 19 more
CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Advanced Cluster Security and 18 more
CVE-2022-30632

Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 15 more
CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf and 13 more