CVE-2022-24675: Buffer Overflow
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Other sources
encoding/pem: fix stack overflow in Decode
A large (more than 5 MB) PEM input can cause a stack overflow in Decode, leading the program to crash.
Thanks to Juho Nurminen of Mattermost who reported the error.
This is CVE-2022-24675 and https://go.dev/issue/51853.
— Red Hat
Golang Go is vulnerable to a denial of service, caused by a stack-based buffer overflow in encoding/pem in the Decode feature. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause the program to crash.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-24675?
CVE-2022-24675 is a vulnerability in encoding/pem in Go before version 1.17.9 and 1.18.x before 1.18.1, which can lead to a stack overflow when decoding a large amount of PEM data.
How severe is CVE-2022-24675?
CVE-2022-24675 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2022-24675?
Encoding/pem in Go versions before 1.17.9 and 1.18.x before 1.18.1 are affected by CVE-2022-24675.
How can I fix CVE-2022-24675?
To fix CVE-2022-24675, update your Go installation to version 1.17.9 or 1.18.1.
Where can I find more information about CVE-2022-24675?
You can find more information about CVE-2022-24675 at the following references: [Link 1](https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf), [Link 2](https://groups.google.com/g/golang-announce), [Link 3](https://groups.google.com/g/golang-announce/c/oecdBNLOml8).