Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library compress/gzip

Default version status: unaffected

  • 0 to < 1.17.12affected
  • 1.18.0-0 to < 1.18.4affected

References