encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Priority MEDIUM 45CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 30 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-674.
Summary
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Why it matters now
EPSS 0.0995 95th percentileScored 2026-11-07
Fix Partial Red Hat: 24 advisoriesRed Hat: 18 fixed, 30 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.9; 1.18.0 to before 1.18.1 | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.9; 1.18.0 to before 1.18.1 Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:kubernetes_monitoring_operator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 24 advisories
- RHSA-2023:3914 Released 2023-07-06 · Red Hat rating ImportantRed Hat OpenShift Enterprise security update
- Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
Show 21 more Red Hat advisories
- RHSA-2022:8750 Released 2022-12-01 · Red Hat rating ModerateOpenShift Virtualization 4.11.1 security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:7058 Released 2022-10-19 · Red Hat rating ModerateOpenShift sandboxed containers 1.3.1 security fix and bug fix update
- OpenShift Sandboxed Containers 1.3 openshift-sandboxed-containers/osc-monitor-rhel8, openshift-sandboxed-containers/osc-must-gather-rhel8, openshift-sandboxed-containers/osc-operator-bundle +1
- RHSA-2022:6714 Released 2022-09-26 · Red Hat rating ModerateRHACS 3.72 enhancement and security update
- RHACS 3.72 for RHEL 8 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +3
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
- RHSA-2022:6430 Released 2022-09-13 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update
- 8Base-OADP-1.0 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-operator-bundle +9
- RHSA-2022:6152 Released 2022-09-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2022:6290 Released 2022-09-01 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.0 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
- RHSA-2022:6277 Released 2022-08-31 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.1.5 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.5-1.el8, servicemesh-cni-2.1.5-1.el8, servicemesh-operator-2.1.5-1.el8 +6
- RHSA-2022:6156 Released 2022-08-24 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
- RHSA-2022:6155 Released 2022-08-24 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.11.0 security, enhancement & bugfix update
- RHODF 4.11 for RHEL 8 mcg-5.11.0-22.el8, mcg-redistributable-5.11.0-22.el8
- RHSA-2022:6094 Released 2022-08-23 · Red Hat rating ModerateOpenShift Container Platform 4.10.28 packages and security update
- Red Hat OpenShift Container Platform 4.10 cri-o-1.23.3-13.rhaos4.10.git6af791c.1.el7, cri-o-1.23.3-14.rhaos4.10.git6af791c.1.el8
- RHSA-2022:6040 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless 1.24.0
- Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:6042 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless Client kn 1.24.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
- RHSA-2022:5068 Released 2022-08-10 · Red Hat rating ModerateOpenShift Container Platform 4.11.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
- Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47
- RHSA-2022:5840 Released 2022-08-02 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.3 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7
- RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Importantgo-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
- RHSA-2022:5730 Released 2022-08-01 · Red Hat rating ModerateOpenShift Container Platform 4.10.25 bug fix and security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:5729 Released 2022-08-01 · Red Hat rating ModerateOpenShift Container Platform 4.10.25 security update
- Red Hat OpenShift Container Platform 4.10 atomic-openshift-service-idler-4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 +10
- RHSA-2022:5337 Released 2022-06-30 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.10-1.module+el8.6.0+15486+6d4da7db.aarch64::go-toolset:rhel8 +18
- RHSA-2022:5415 Released 2022-06-30 · Red Hat rating Moderatego-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-golang-1.17.10-1.el7_9, go-toolset-1.17-golang-bin-1.17.10-1.el7_9, go-toolset-1.17-golang-docs-1.17.10-1.el7_9 +4
- RHSA-2022:5006 Released 2022-06-13 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.1.3 Containers security update
- OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-OADP-1.0 | Fixed | RHSA-2022:6430 |
| 8Base-OADP-1.1 | Fixed | RHSA-2022:6290 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:5840 |
| CNV 4.11 for RHEL 8 | Fixed | RHSA-2022:6526, RHSA-2022:8750 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2022:6152 |
| OpenShift Sandboxed Containers 1.3 | Fixed | RHSA-2022:7058 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:5006, RHSA-2022:6277 |
| RHACS 3.72 for RHEL 8 | Fixed | RHSA-2022:6714 |
| RHODF 4.11 for RHEL 8 | Fixed | RHSA-2022:6155, RHSA-2022:6156 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2022:5415 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:5337 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:5799 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:5729, RHSA-2022:5730, RHSA-2022:6094 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5068, RHSA-2023:3914 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:6042 |
| Red Hat OpenShift Serverless 1.24 | Fixed | RHSA-2022:6040 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 18 products
- 8Base-OADP-1.0
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.11 for RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.11
- OSSO 1.1 for RHEL 8
- OpenShift Service Mesh 2.1
- RHACS 3.72 for RHEL 8
- RHODF 4.11 for RHEL 8
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenStack Platform 16.2
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24675
- 2026-10-03 Alias added: GHSA-q42m-q8hq-53rj
References
Advisory 10
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/oecdBNLOml8
- FEDORA-2022-a49babed75
- FEDORA-2022-c0f780ecf1
- FEDORA-2022-e46e6e8317
- FEDORA-2022-fae3ecee19
- FEDORA-2022-ba365d3703
- GLSA-202208-02
- FEDORA-2022-30c5ed5625
- https://security.netapp.com/advisory/ntap-20220915-0010/
Sources
- CVE-2022-24675 · CVE Program
- CVE-2022-24675 · NVD
- FIRST EPSS
- GHSA-q42m-q8hq-53rj · GitHub Advisory Database · CC BY 4.0
- CVE-2022-24675 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences