Read the docs
TI-2022-01821 Aliases CVE-2022-1962GHSA-6mwq-4j3f-rr3x

Stack exhaustion due to deeply nested types in go/parser

Priority LOW 27CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 17 fixed, 20 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00916 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial go/parser (Go standard library): 1.17.12, 1.18.4Red Hat: 27 advisoriesRed Hat: 17 fixed, 20 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygo/parserbefore 1.17.12; 1.18.0-0 to before 1.18.41.17.12, 1.18.4Patch availableCNA
  • go/parser VendorGo standard library Affected before 1.17.12; 1.18.0-0 to before 1.18.4 Fixed in 1.17.12, 1.18.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.17.12; 1.18.0 to before 1.18.4VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.12; 1.18.0 to before 1.18.4 Vulnerable ·Go standard library

Remediation

  • Fix · CNA go/parser (Go standard library) Fixed in 1.17.12, 1.18.4

Red Hat 27 advisories

  • RHSA-2024:1433 Released 2024-03-20 · Red Hat rating Moderate
    Migration Toolkit for Applications security and bug fix update
    • MTA 7.0 for RHEL 9 mta/mta-hub-rhel9
  • RHSA-2024:1027 Released 2024-02-28 · Red Hat rating Moderate
    Migration Toolkit for Applications security update
    • MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-pathfinder-rhel9 +3
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
Show 24 more Red Hat advisories
  • RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
  • RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
  • RHSA-2023:1042 Released 2023-03-06 · Red Hat rating Moderate
    Custom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
  • RHSA-2023:0408 Released 2023-01-25 · Red Hat rating Important
    OpenShift Virtualization 4.12.0 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
  • RHSA-2023:0407 Released 2023-01-24 · Red Hat rating Moderate
    OpenShift Virtualization 4.12.0 RPMs security update
    • CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
    • CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
  • RHSA-2022:9047 Released 2022-12-15 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
  • RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Important
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
  • RHSA-2022:7529 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.aarch64::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.ppc64le::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.s390x::container-tools:3.0 +47
  • RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderate
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
  • RHSA-2022:6430 Released 2022-09-13 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update
    • 8Base-OADP-1.0 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-operator-bundle +9
  • RHSA-2022:6370 Released 2022-09-06 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2022:6345 Released 2022-09-06 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.1 security updates and bug fixes
    • multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
  • RHSA-2022:6347 Released 2022-09-06 · Red Hat rating Moderate
    VolSync 0.5 security fixes and updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
  • RHSA-2022:6348 Released 2022-09-06 · Red Hat rating Moderate
    Gatekeeper Operator v0.2 security and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/gatekeeper-operator-bundle, rhacm2/gatekeeper-rhel8, rhacm2/gatekeeper-rhel8-operator
  • RHSA-2022:6346 Released 2022-09-06 · Red Hat rating Moderate
    RHSA: Submariner 0.13 - security and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
  • RHSA-2022:6152 Released 2022-09-01 · Red Hat rating Important
    Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2022:6283 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.2 Containers security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/pilot-rhel8 +3
  • RHSA-2022:6188 Released 2022-08-25 · Red Hat rating Important
    Node Maintenance Operator 4.11.1 security update
    • Node Maintenance Operator 4.11 for RHEL 8 workload-availability/node-maintenance-rhel8-operator
  • RHSA-2022:6113 Released 2022-08-18 · Red Hat rating Important
    Red Hat Application Interconnect 1.0 Release (rpms)
    • Red Hat Service Interconnect 1 skupper-cli-1.0.2-2.el8
  • RHSA-2022:6040 Released 2022-08-10 · Red Hat rating Important
    Release of OpenShift Serverless 1.24.0
    • Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
  • RHSA-2022:6042 Released 2022-08-10 · Red Hat rating Important
    Release of OpenShift Serverless Client kn 1.24.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
  • RHSA-2022:5866 Released 2022-08-02 · Red Hat rating Important
    go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-1.17.12-1.el7_9, go-toolset-1.17-build-1.17.12-1.el7_9, go-toolset-1.17-golang-1.17.12-1.el7_9 +8
  • RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Important
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
  • RHSA-2022:5775 Released 2022-08-01 · Red Hat rating Important
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.12-1.module+el8.6.0+16014+a372c00b.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 2AffectedNo fix yet: Fix deferred
Fence Agents Remediation OperatorAffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix planned: Will not fix
NBDE Tang ServerAffectedNo fix planned: Will not fix
Node Maintenance OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Service Interconnect 1AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Red Hat Web TerminalAffectedNo fix yet
8Base-OADP-1.0Fixed RHSA-2022:6430
8Base-RHMTC-1.7Fixed RHSA-2022:9047
CNV 4.12 for RHEL 7Fixed RHSA-2023:0407
CNV 4.12 for RHEL 8Fixed RHSA-2023:0407, RHSA-2023:0408
MTA 6.2 for RHEL 8Fixed RHSA-2024:1027
MTA 7.0 for RHEL 9Fixed RHSA-2024:1433
Node Maintenance Operator 4.11 for RHEL 8Fixed RHSA-2022:6188
OSSO 1.1 for RHEL 8Fixed RHSA-2022:6152
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2023:1042
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:0778
RHOSSM 2.2 for RHEL 8Fixed RHSA-2022:6283
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:5866
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:5775, RHSA-2022:7519, RHSA-2022:7529, RHSA-2023:2758, RHSA-2023:2802
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:5799, RHSA-2022:8057
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:6042
Red Hat OpenShift Serverless 1.24Fixed RHSA-2022:6040
Red Hat Service Interconnect 1Fixed RHSA-2022:6113
Not affected: 35 products
  • 8Base-OADP-1.0
  • 8Base-RHMTC-1.7
  • Builds for Red Hat OpenShift
  • CNV 4.12 for RHEL 8
  • Cost Management Metrics Operator
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • MTA 7.0 for RHEL 8
  • MTA 7.0 for RHEL 9
  • Machine Deletion Remediation Operator
  • Migration Toolkit for Virtualization
  • Network Observability Operator
  • Node HealthCheck Operator
  • Node Maintenance Operator 4.11 for RHEL 8
  • OSSO 1.1 for RHEL 8
  • OpenShift Custom Metrics Autoscaler 2
  • OpenShift Developer Tools and Services
  • OpenShift Developer Tools and Services for OCP 4.12
  • OpenShift Run Once Duration Override Operator
  • RHOSSM 2.2 for RHEL 8
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat Advanced Cluster Security 4
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Self Node Remediation Operator
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1962
  2. 2026-10-03 Alias added: GHSA-6mwq-4j3f-rr3x

References

Exploit 1

Patch 2

Advisory 2

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences