Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow…
Priority LOW 38CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 20 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Why it matters now
EPSS 0.02807 86th percentileScored 2026-11-07
Fix Partial Red Hat: 14 advisoriesRed Hat: 12 fixed, 20 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.16.14; 1.17.0 to before 1.17.7 | Vulnerable | Go standard library |
| cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.16.14; 1.17.0 to before 1.17.7 Vulnerable ·Go standard library
- cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_insights_telegraf_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
Red Hat 14 advisories
- RHSA-2024:6412 Released 2024-09-11 · Red Hat rating ModerateOpenShift Container Platform 4.14.36 security update
- Red Hat OpenShift Container Platform 4.14 haproxy-2.6.13-4.rhaos4.14.el8, haproxy26-2.6.13-4.rhaos4.14.el8, openshift-4.14.0-202409041843.p0.g03a907c.assembly.stream.el8 +3
- RHSA-2024:5754 Released 2024-08-28 · Red Hat rating ModerateOpenShift Container Platform 4.15.29 packages and security update
- Red Hat OpenShift Container Platform 4.15 openshift-4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el8, openshift-4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el9, openshift-hyperkube-4.15.0-202408131909.p0.gbc3c7c5.assembly.stream.el8 +1
- RHSA-2023:3914 Released 2023-07-06 · Red Hat rating ImportantRed Hat OpenShift Enterprise security update
- Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
Show 11 more Red Hat advisories
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6156 Released 2022-08-24 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
- RHSA-2022:6155 Released 2022-08-24 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.11.0 security, enhancement & bugfix update
- RHODF 4.11 for RHEL 8 mcg-5.11.0-22.el8, mcg-redistributable-5.11.0-22.el8
- RHSA-2022:5068 Released 2022-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.11.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
- Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
- RHSA-2022:5730 Released 2022-08-01 · Red Hat rating ModerateOpenShift Container Platform 4.10.25 bug fix and security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:5004 Released 2022-06-13 · Red Hat rating CriticalRed Hat OpenShift Service Mesh 2.1.3 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.3-1.el8, servicemesh-cni-2.1.3-1.el8, servicemesh-operator-2.1.3-2.el8 +6
- RHSA-2022:4863 Released 2022-06-01 · Red Hat rating ModerateRelease of OpenShift Serverless Version 1.22.1
- Red Hat OpenShift Serverless 1.22 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:4860 Released 2022-06-01 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.22.1
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.1.0-3.el8
- RHSA-2022:1819 Released 2022-05-10 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.7-1.module+el8.6.0+14297+32a15e19.aarch64::go-toolset:rhel8 +18
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| CNV 4.11 for RHEL 8 | Fixed | RHSA-2022:6526 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0408 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:5004 |
| RHODF 4.11 for RHEL 8 | Fixed | RHSA-2022:6155, RHSA-2022:6156 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1819 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:5730 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5068, RHSA-2023:3914 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:6412 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:5754 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:4860 |
| Red Hat OpenShift Serverless 1.22 | Fixed | RHSA-2022:4863 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 15 products
- CNV 4.11 for RHEL 8
- CNV 4.12 for RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.11
- RHODF 4.11 for RHEL 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenShift on AWS
- Red Hat OpenStack Platform 16.2
- Red Hat Storage 3
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23772
- 2026-10-03 Alias added: GHSA-q99m-p7hq-5v4f
References
Advisory 6
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2985-1] golang-1.7 security update
- [debian-lts-announce] 20220428 [SECURITY] [DLA 2986-1] golang-1.8 security update
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ
- https://security.netapp.com/advisory/ntap-20220225-0006/
- GLSA-202208-02
Sources
- CVE-2022-23772 · CVE Program
- CVE-2022-23772 · NVD
- FIRST EPSS
- GHSA-q99m-p7hq-5v4f · GitHub Advisory Database · CC BY 4.0
- CVE-2022-23772 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences