CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
60.1%
Programs which compile regular expressions from untrusted sources may be
vulnerable to memory exhaustion or denial of service. The parsed regexp
representation is linear in the size of the input, but in some cases the
constant factor can be as high as 40,000, making relatively small regexps
consume much larger amounts of memory. After fix, each regexp being parsed
is limited to a 256 MB memory footprint. Regular expressions whose
representation would use more space than that are rejected. Normal use of
regular expressions is unaffected.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 14.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 22.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.14 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.16 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.16 | < any | UNKNOWN |
github.com/golang/go/commit/645abfe529dc325e16daa17210640c2907d1c17a (go1.19.2)
github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997 (go1.18.7)
go.dev/issue/55949
launchpad.net/bugs/cve/CVE-2022-41715
nvd.nist.gov/vuln/detail/CVE-2022-41715
security-tracker.debian.org/tracker/CVE-2022-41715
ubuntu.com/security/notices/USN-6038-1
www.cve.org/CVERecord?id=CVE-2022-41715