golang: compress/gzip: stack exhaustion in Reader.Read

🗓️ 17 Jan 2023 19:29:22Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 9 Views

Golang gzip Reader Read may panic from stack exhaustion with many concatenated zero length files.

Reporter	Title	Published	Views	Family All 408
ibm	Security Bulletin: Multiple vulnerabilities in Go may affect IBM CICS TX Standard	24 Feb 202310:43	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
ibm	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to uncontrolled recursion in golang (CVE-2022-30631)	4 Apr 202521:20	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in the mongo-tools utility affect IBM WebSphere Automation	29 Mar 202317:13	–	ibm
ibm	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is affected by multiple vulnerabilities in Golang Go	5 Jul 202321:52	–	ibm
ibm	Security Bulletin: Vulnerabilities in Golang Go affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift	18 Nov 202200:02	–	ibm
ibm	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to multiple software weaknesses due to Golang	4 Apr 202521:17	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container operator and IntegrationServer operands may be vulnerable to denial of service due to CVE-2022-30631	4 Nov 202216:44	–	ibm
ibm	Security Bulletin: Vulnerabilities in IBM Db2, Golang Go, and Logback may affect the IBM Spectrum Protect Server (CVE-2022-30631, CVE-2022-30633, CVE-2022-1705, CVE-2022-22389, CVE-2022-22390, CVE-2021-42550, CVE-2022-30629)	17 Sep 202202:57	–	ibm
ibm	Security Bulletin: Mutiple Vulnerabilties Affecting Watson Machine Learning Accelerator on Cloud Pak for Data version	13 Nov 202315:22	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	butane	0.16.0-2.rhaos4.12.el8	butane-0.16.0-2.rhaos4.12.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	butane	0.16.0-2.rhaos4.12.el8	butane-0.16.0-2.rhaos4.12.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	butane	0.16.0-2.rhaos4.12.el8	butane-0.16.0-2.rhaos4.12.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	butane	0.16.0-2.rhaos4.12.el8	butane-0.16.0-2.rhaos4.12.el8.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	butane-debuginfo	0.16.0-2.rhaos4.12.el8	butane-debuginfo-0.16.0-2.rhaos4.12.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	butane-debuginfo	0.16.0-2.rhaos4.12.el8	butane-debuginfo-0.16.0-2.rhaos4.12.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	butane-debuginfo	0.16.0-2.rhaos4.12.el8	butane-debuginfo-0.16.0-2.rhaos4.12.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	butane-debuginfo	0.16.0-2.rhaos4.12.el8	butane-debuginfo-0.16.0-2.rhaos4.12.el8.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	butane-debugsource	0.16.0-2.rhaos4.12.el8	butane-debugsource-0.16.0-2.rhaos4.12.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	butane-debugsource	0.16.0-2.rhaos4.12.el8	butane-debugsource-0.16.0-2.rhaos4.12.el8.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-30631
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/issue/53168
groups	www.groups.google.com/g/golang-announce/c/nqrv9fbR0zE
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-30631
cve	www.cve.org/CVERecord

16 Jul 2026 14:08Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.01623

SSVC

golang gzip reader stack exhaustion concatenated files zero length files panic