CVE-2022-32189 Panic when decoding Float and Rat types in math/big

2022-08-0920:17:59

www.cve.org

cve-2022-32189

panic

float

rat

math/big

denial of service

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

57.2%

JSON

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "math/big",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "math/big",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.17.13",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.18.0-0",
        "lessThan": "1.18.5",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Float.GobDecode"
      },
      {
        "name": "Rat.GobDecode"
      }
    ],
    "defaultStatus": "unaffected"
  }
]