Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-32189

Panic when decoding Float and Rat types in math/big

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library math/big

Default version status: unaffected

  • 0 to < 1.17.13affected
  • 1.18.0-0 to < 1.18.5affected

References