Stack exhaustion from deeply nested XML documents in encoding/xml
Priority LOW 38CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 14 fixed, 22 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-674.
Summary
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
Why it matters now
EPSS 0.02559 85th percentileScored 2026-11-07
Fix Partial encoding/xml (Go standard library): 1.17.12, 1.18.4Red Hat: 24 advisoriesRed Hat: 14 fixed, 22 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | encoding/xml | before 1.17.12; 1.18.0-0 to before 1.18.4 | 1.17.12, 1.18.4 | Patch available | CNA |
- encoding/xml VendorGo standard library Affected before 1.17.12; 1.18.0-0 to before 1.18.4 Fixed in 1.17.12, 1.18.4 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.12; 1.18.0 to before 1.18.4 | Vulnerable | Go standard library |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.12; 1.18.0 to before 1.18.4 Vulnerable ·Go standard library
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA encoding/xml (Go standard library) Fixed in 1.17.12, 1.18.4
Red Hat 24 advisories
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
- RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
Show 21 more Red Hat advisories
- RHSA-2023:1042 Released 2023-03-06 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2023:0407 Released 2023-01-24 · Red Hat rating ModerateOpenShift Virtualization 4.12.0 RPMs security update
- CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
- CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
- RHSA-2022:9047 Released 2022-12-15 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
- RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Importantgrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
- RHSA-2022:7529 Released 2022-11-08 · Red Hat rating Moderatecontainer-tools:3.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.aarch64::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.ppc64le::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.s390x::container-tools:3.0 +47
- RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
- RHSA-2022:6370 Released 2022-09-06 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
- RHSA-2022:6345 Released 2022-09-06 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.1 security updates and bug fixes
- multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
- RHSA-2022:6347 Released 2022-09-06 · Red Hat rating ModerateVolSync 0.5 security fixes and updates
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
- RHSA-2022:6348 Released 2022-09-06 · Red Hat rating ModerateGatekeeper Operator v0.2 security and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/gatekeeper-operator-bundle, rhacm2/gatekeeper-rhel8, rhacm2/gatekeeper-rhel8-operator
- RHSA-2022:6346 Released 2022-09-06 · Red Hat rating ModerateRHSA: Submariner 0.13 - security and enhancement update
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
- RHSA-2022:6152 Released 2022-09-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2022:6283 Released 2022-08-31 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.2.2 Containers security update
- RHOSSM 2.2 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/pilot-rhel8 +3
- RHSA-2022:6188 Released 2022-08-25 · Red Hat rating ImportantNode Maintenance Operator 4.11.1 security update
- Node Maintenance Operator 4.11 for RHEL 8 workload-availability/node-maintenance-rhel8-operator
- RHSA-2022:6113 Released 2022-08-18 · Red Hat rating ImportantRed Hat Application Interconnect 1.0 Release (rpms)
- Red Hat Service Interconnect 1 skupper-cli-1.0.2-2.el8
- RHSA-2022:6040 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless 1.24.0
- Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:6042 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless Client kn 1.24.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
- RHSA-2022:5866 Released 2022-08-02 · Red Hat rating Importantgo-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-1.17.12-1.el7_9, go-toolset-1.17-build-1.17.12-1.el7_9, go-toolset-1.17-golang-1.17.12-1.el7_9 +8
- RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Importantgo-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
- RHSA-2022:5775 Released 2022-08-01 · Red Hat rating Importantgo-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.12-1.module+el8.6.0+16014+a372c00b.aarch64::go-toolset:rhel8 +18
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library encoding/xml 1.17.12, 1.18.4
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-12769 Stack exhaustion when unmarshaling certain documents in encoding/xmlPriority MEDIUM 43
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift API for Data Protection | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Web Terminal | Affected | No fix yet |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:9047 |
| CNV 4.12 for RHEL 7 | Fixed | RHSA-2023:0407 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0407, RHSA-2023:0408 |
| Node Maintenance Operator 4.11 for RHEL 8 | Fixed | RHSA-2022:6188 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2022:6152 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2023:1042 |
| RHOSSM 2.2 for RHEL 8 | Fixed | RHSA-2022:6283 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2022:5866 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:5775, RHSA-2022:7519, RHSA-2022:7529, RHSA-2023:2758, RHSA-2023:2802 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:5799, RHSA-2022:8057 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:6042 |
| Red Hat OpenShift Serverless 1.24 | Fixed | RHSA-2022:6040 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2022:6113 |
Not affected: 10 products
- 8Base-RHMTC-1.7
- CNV 4.12 for RHEL 8
- Node Maintenance Operator 4.11 for RHEL 8
- OSSO 1.1 for RHEL 8
- OpenShift Custom Metrics Autoscaler 2
- RHOSSM 2.2 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28131
- 2026-10-03 Alias added: GHSA-3p2w-3263-9gr3
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-28131 · CVE Program
- CVE-2022-28131 · NVD
- FIRST EPSS
- GHSA-3p2w-3263-9gr3 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-28131 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences