{"id":"CVE-2022-32189","state":"PUBLISHED","title":"Panic when decoding Float and Rat types in math/big","description":"A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.","publishedAt":"2022-08-09T20:17:59.000Z","updatedAt":"2026-10-08T21:24:19.098Z","severity":null,"assigner":"Go","products":["Go standard library math/big"],"affected":[{"vendor":"Go standard library","product":"math/big","packageName":"math/big","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.17.13","versionType":"semver"},{"version":"1.18.0-0","status":"affected","lessThan":"1.18.5","versionType":"semver"}],"collectionURL":"https://pkg.go.dev","programRoutines":[{"name":"Float.GobDecode"},{"name":"Rat.GobDecode"}]}],"references":["https://go.dev/cl/417774","https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66","https://go.dev/issue/53871","https://groups.google.com/g/golang-announce/c/YqYYG87xB10","https://pkg.go.dev/vuln/GO-2022-0537"],"weaknesses":[],"ingestedAt":"2026-10-29T19:50:09.278Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/32xxx/CVE-2022-32189.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-32189","state":"PUBLISHED","datePublished":"2022-08-09T20:17:59.000Z","dateUpdated":"2026-10-08T21:24:19.098Z","assignerShortName":"Go","assignerOrgId":"1bb62c36-49e3-4200-9d77-64a1400537cc","dateReserved":"2022-05-31T00:00:00.000Z"},"containers":{"cna":{"title":"Panic when decoding Float and Rat types in math/big","descriptions":[{"lang":"en","value":"A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service."}],"affected":[{"vendor":"Go standard library","product":"math/big","packageName":"math/big","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.17.13","versionType":"semver"},{"version":"1.18.0-0","status":"affected","lessThan":"1.18.5","versionType":"semver"}],"collectionURL":"https://pkg.go.dev","programRoutines":[{"name":"Float.GobDecode"},{"name":"Rat.GobDecode"}]}],"references":[{"url":"https://go.dev/cl/417774"},{"url":"https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66"},{"url":"https://go.dev/issue/53871"},{"url":"https://groups.google.com/g/golang-announce/c/YqYYG87xB10"},{"url":"https://pkg.go.dev/vuln/GO-2022-0537"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE 400: Uncontrolled Resource Consumption"}]}],"providerMetadata":{"shortName":"Go","orgId":"1bb62c36-49e3-4200-9d77-64a1400537cc","dateUpdated":"2023-06-12T19:05:15.506Z"},"credits":[{"lang":"en","value":"@catenacyber"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://go.dev/cl/417774","tags":["x_transferred"]},{"url":"https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66","tags":["x_transferred"]},{"url":"https://go.dev/issue/53871","tags":["x_transferred"]},{"url":"https://groups.google.com/g/golang-announce/c/YqYYG87xB10","tags":["x_transferred"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0537","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T07:32:56.026Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-32189","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:15:01.748232Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T21:24:19.098Z"}}]}}}