Skip to content
OpenAdvisories
High · 7.5 CVE-2022-30635 BIT-golang-2022-30635EUVD-2022-52466GHSA-5fhx-39r8-3jwhGO-2022-0526

Stack exhaustion when decoding certain messages in encoding/gob

Published Aug 9, 2022 · Updated Mar 6, 2026 · Assigned by Go

Description

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Affected products

VendorProductAffectedFixed
Go standard library encoding/gob < 1.17.12, 1.18.0-0 – < 1.18.4 1.17.12

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 12 golang-1.19 1.19~rc2-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS golang-1.13 1.13.8-1ubuntu2.22.04.2 USN-6038-2
Ubuntu 22.04 LTS golang-1.18 1.18.1-1ubuntu1.1 USN-6038-1
Ubuntu 20.04 LTS golang-1.13 1.13.8-1ubuntu1.2 USN-6038-2
Ubuntu 20.04 LTS golang-1.16 1.16.2-0ubuntu1~20.04.1 USN-6038-2
Ubuntu 20.04 LTS golang-1.18 1.18.1-1ubuntu1~20.04.2 USN-6038-1
Ubuntu 18.04 LTS golang-1.18 1.18.1-1ubuntu1~18.04.4 USN-6038-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS golang-1.13 1.13.8-1ubuntu1~18.04.4+esm1 USN-6038-2
Ubuntu Pro 18.04 LTS golang-1.16 1.16.2-0ubuntu1~18.04.2+esm1 USN-6038-2
Ubuntu Pro 16.04 LTS golang-1.13 1.13.8-1ubuntu1~16.04.3+esm3 USN-6038-2
ReleasePackageFixed inAdvisory
RHEL 9 git-lfs 3.2.0-1.el9 RHSA-2023:2357
RHEL 9 golang +7 1.17.12-1.el9_0 RHSA-2022:5799
RHEL 9 grafana 7.5.15-3.el9 RHSA-2022:8057
RHEL 9 grafana-pcp 3.2.0-3.el9 RHSA-2022:8250
RHEL 8 buildah +1 1:1.24.6-5.module+el8.8.0+18083+cd85596b RHSA-2023:2802, RHSA-2023:2758
RHEL 8 cockpit-podman 46-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 conmon 2:2.1.4-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 container-selinux 2:2.199.0-1.module+el8.8.0+18113+8b5b6979 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 containernetworking-plugins 1:1.1.1-2.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 containers-common 2:1-37.module+el8.8.0+17954+9046de88 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 crit +4 3.15-3.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 crun 1.6-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 delve 1.7.2-1.module+el8.6.0+12972+ebab5911 RHSA-2022:5775
RHEL 8 fuse-overlayfs 1.9-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 git-lfs 2.13.3-3.el8_6 RHSA-2022:7129
RHEL 8 golang +7 1.17.12-1.module+el8.6.0+16014+a372c00b RHSA-2022:5775
RHEL 8 grafana 7.5.15-3.el8 RHSA-2022:7519
RHEL 8 grafana-pcp 3.2.0-2.el8 RHSA-2022:7648
RHEL 8 libslirp +1 4.4.0-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 netavark +1 2:1.0.1-37.module+el8.8.0+17954+9046de88 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 oci-seccomp-bpf-hook 1.2.5-2.module+el8.8.0+18083+cd85596b RHSA-2023:2802, RHSA-2023:2758
RHEL 8 podman +6 2:4.0.2-20.module+el8.8.0+18201+6ad7332c RHSA-2023:2802, RHSA-2023:2758
RHEL 8 python-podman +1 4.0.0-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 runc 1:1.1.4-1.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 skopeo +1 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 slirp4netns 1.1.8-2.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 toolbox +1 0.0.99.3-7.module+el8.8.0+18115+45021590 RHSA-2023:2802, RHSA-2023:2758
RHEL 8 udica 0.2.6-3.module+el8.8.0+17821+de1b53f1 RHSA-2023:2802, RHSA-2023:2758
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Serverless 1 openshift-serverless-clients 1.3.1-4.el8 RHSA-2022:6042
Red Hat OpenStack 16 etcd 3.3.23-12.el8ost RHSA-2023:1275
Red Hat Devtools 2022 go-toolset-1.17 +10 1.17.12-1.el7_9 RHSA-2022:5866
Red Hat Container Native Virtualization 4 kubevirt +2 4.12.0-1057.el7 RHSA-2023:0407

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 git-lfs 3.2.0-1.el9 ALSA-2023:2357
AlmaLinux 9 golang +6 1.17.12-1.el9_0 ALSA-2022:5799
AlmaLinux 9 grafana 7.5.15-3.el9 ALSA-2022:8057
AlmaLinux 9 grafana-pcp 3.2.0-3.el9 ALSA-2022:8250
AlmaLinux 8 buildah +1 1:1.24.6-5.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 cockpit-podman 46-1.module_el8.7.0+3344+5bcd850f ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 conmon 2:2.1.4-1.module_el8.7.0+3344+5bcd850f ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 container-selinux 2:2.199.0-1.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 containernetworking-plugins 1:1.1.1-2.module_el8.7.0+3344+5bcd850f ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 containers-common 2:1-37.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 crit +4 3.15-3.module_el8.6.0+2877+8e437bf5 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 crun 1.6-1.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 delve 1.7.2-1.module_el8.6.0+2736+ec10aba8 ALSA-2022:5775
AlmaLinux 8 fuse-overlayfs 1.9-1.module_el8.7.0+3344+5bcd850f ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 git-lfs 2.13.3-3.el8_6 ALSA-2022:7129
AlmaLinux 8 golang +7 1.17.12-1.module_el8.6.0+3065+e17ed2d4 ALSA-2022:5775
AlmaLinux 8 grafana 7.5.15-3.el8 ALSA-2022:7519
AlmaLinux 8 grafana-pcp 3.2.0-2.el8 ALSA-2022:7648
AlmaLinux 8 libslirp +1 4.4.0-1.module_el8.6.0+2877+8e437bf5 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 netavark +1 2:1.0.1-37.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 oci-seccomp-bpf-hook 1.2.5-2.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 podman +6 2:4.0.2-20.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 python3-podman 4.0.0-1.module_el8.6.0+2877+8e437bf5 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 runc 1:1.1.4-1.module_el8.7.0+3344+5bcd850f ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 skopeo +1 2:1.6.2-6.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 slirp4netns 1.1.8-2.module_el8.6.0+2877+8e437bf5 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 toolbox +1 0.0.99.3-7.module_el8.8.0+3468+16b86c82 ALSA-2023:2802, ALSA-2023:2758
AlmaLinux 8 udica 0.2.6-3.module_el8.6.0+2886+d33c3efb ALSA-2023:2802, ALSA-2023:2758

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 golang +1 1.17.12-1.el9_0 RLSA-2022:5799
Rocky Linux 9 grafana 7.5.15-3.el9 RLSA-2022:8057
Rocky Linux 9 grafana-pcp 3.2.0-3.el9 RLSA-2022:8250
Rocky Linux 8 cockpit-podman 46-1.module+el8.9.0+1445+07728297 RLSA-2023:2802
Rocky Linux 8 criu 3.15-3.module+el8.9.0+1445+07728297 RLSA-2023:2802, RLSA-2023:2758
Rocky Linux 8 delve 1.7.2-1.module+el8.6.0+824+8e984c20 RLSA-2022:5775
Rocky Linux 8 git-lfs 2.13.3-3.el8_6 RLSA-2022:7129
Rocky Linux 8 golang +1 1.17.12-1.module+el8.6.0+993+4fde2340 RLSA-2022:5775
Rocky Linux 8 grafana 7.5.15-3.el8 RLSA-2022:7519
Rocky Linux 8 grafana-pcp 3.2.0-2.el8 RLSA-2022:7648
Rocky Linux 8 libslirp 4.4.0-1.module+el8.9.0+1445+07728297 RLSA-2023:2802, RLSA-2023:2758
Rocky Linux 8 oci-seccomp-bpf-hook 1.2.5-2.module+el8.9.0+1445+07728297 RLSA-2023:2802
ReleasePackageFixed inAdvisory
SLES 15 SP4 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SLES 15 SP4 go1.18 1.18.5-150000.1.25.1 SUSE-SU-2022:2672-1
SLES 15 SP4 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
SLES 15 SP3 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SLES 15 SP3 go1.18 1.18.5-150000.1.25.1 SUSE-SU-2022:2672-1
SLES 15 SP3 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
SLES 15 SP2 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
SLES for SAP 15 SP2 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SLE Real Time 15 SP3 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
SLE HPC 15 SP3 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
SLE HPC 15 SP2 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SUSE Manager Server 4.1 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SUSE Manager Retail Branch Server 4.1 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SUSE Manager Proxy 4.1 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
SUSE Enterprise Storage 7.1 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
SUSE Enterprise Storage 7 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.17 1.17.12-1.1 openSUSE-SU-2024:12189-1
openSUSE Tumbleweed go1.18 1.18.4-1.1 openSUSE-SU-2024:12190-1
openSUSE Leap 15.5 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
openSUSE Leap 15.4 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
openSUSE Leap 15.4 go1.18 1.18.5-150000.1.25.1 SUSE-SU-2022:2672-1
openSUSE Leap 15.4 go1.18-openssl 1.18.10.1-150000.1.9.1 SUSE-SU-2023:2312-1
openSUSE Leap 15.3 go1.17 1.17.13-150000.1.42.1 SUSE-SU-2022:2671-1
openSUSE Leap 15.3 go1.18 1.18.5-150000.1.25.1 SUSE-SU-2022:2672-1
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.18.4-r0 —
Alpine v3.23 go 1.18.4-r0 —
Alpine v3.22 go 1.18.4-r0 —
Alpine v3.21 go 1.18.4-r0 —
Alpine v3.20 go 1.18.4-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 go 1.18.4-r0 —
Alpine v3.18 go 1.18.4-r0 —
Alpine v3.17 go 1.18.4-r0 —
Alpine v3.16 go 1.18.4-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +7 1.19.3-2.amzn2023.0.2 ALAS2023-2023-048
Amazon Linux 2023 golang-github-cpuguy83-md2man +2 2.0.2-22.amzn2023.0.2 ALAS2023-2023-047
Amazon Linux 2023 golist 0.10.1-11.amzn2023.0.3 ALAS2023-2023-046
Amazon Linux 2 go-filesystem +3 3.0.15-23.amzn2.0.2 ALAS2-2022-1863
Amazon Linux 2 golang +7 1.18.5-1.amzn2 ALAS2-2022-1846
Amazon Linux 2 golang-github-godbus-dbus-devel 0-0.1.gitcb98efb.amzn2.0.2 ALAS2-2022-1858
Amazon Linux 2 golang-github-gorilla-context-devel 0-0.24.gitb06ed15.amzn2.0.4 ALAS2-2022-1859
Amazon Linux 2 golang-github-gorilla-mux-devel 0-0.16.git136d54f.amzn2.0.2 ALAS2-2022-1860
Amazon Linux 2 golang-github-kr-pty-devel 0-0.19.git98c7b80.amzn2.0.3 ALAS2-2022-1864
Amazon Linux 2 golang-github-syndtr-gocapability-devel 0-0.5.git3454319.amzn2.0.3 ALAS2-2022-1865
Amazon Linux 2 golang-googlecode-net-devel 0-0.12.hg84a4013f96e0.amzn2.0.2 ALAS2-2022-1861
Amazon Linux 2 golang-googlecode-sqlite-devel 0-0.9.hg74691fb6f837.amzn2.0.4 ALAS2-2022-1862
Amazon Linux 2 golist 0.10.1-10.amzn2.0.1 ALAS2-2022-1847

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —
Azure Linux 2 (CBL-Mariner) golang 1.18.5-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 git-lfs 3.2.0-1.el9 ELSA-2023-2357
Oracle Linux 9 golang +7 1.17.12-1.el9_0 ELSA-2022-5799
Oracle Linux 9 grafana 7.5.15-3.el9 ELSA-2022-8057
Oracle Linux 9 grafana-pcp 3.2.0-3.el9 ELSA-2022-8250
Oracle Linux 8 buildah +1 1:1.24.6-5.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 cockpit-podman 46-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 conmon 2:2.1.4-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 container-selinux 2:2.199.0-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 containernetworking-plugins 1:1.1.1-2.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 containers-common 2:1-37.0.1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 crit +4 3.15-3.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 crun 1.6-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 delve 1.7.2-1.0.1.module+el8.6.0+20559+3b94dc2a ELSA-2022-24267, ELSA-2022-23681, ELSA-2022-5775
Oracle Linux 8 fuse-overlayfs 1.9-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 git-lfs 2.13.3-3.el8_6 ELSA-2022-7129
Oracle Linux 8 golang +7 1.17.12-1.module+el8.6.0+20710+66aa75bb ELSA-2022-24267, ELSA-2022-23681, ELSA-2022-5775
Oracle Linux 8 grafana 7.5.15-3.el8 ELSA-2022-7519
Oracle Linux 8 grafana-pcp 3.2.0-2.el8 ELSA-2022-7648
Oracle Linux 8 libslirp +1 4.4.0-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 netavark +1 2:1.0.1-37.0.1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 oci-seccomp-bpf-hook 1.2.5-2.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 podman +6 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 python3-podman 4.0.0-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 runc 1:1.1.4-1.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 skopeo +1 2:1.6.2-6.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 slirp4netns 1.1.8-2.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758
Oracle Linux 8 udica 0.2.6-3.module+el8.8.0+20984+ab6ce66c ELSA-2023-2802, ELSA-2023-2758

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.17.12 · >= 1.18.0-0, < 1.18.4 1.17.12, 1.18.4 GO-2022-0526

Advisories 50

References