Read the docs
TI-2022-12771 Aliases CVE-2022-30635GHSA-5fhx-39r8-3jwh

Stack exhaustion when decoding certain messages in encoding/gob

Priority MEDIUM 43CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01915 79th percentileScored 2026-11-07
Fix Partial encoding/gob (Go standard library): 1.17.12, 1.18.4Red Hat: 28 advisoriesRed Hat: 16 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard libraryencoding/gobbefore 1.17.12; 1.18.0-0 to before 1.18.41.17.12, 1.18.4Patch availableCNA
  • encoding/gob VendorGo standard library Affected before 1.17.12; 1.18.0-0 to before 1.18.4 Fixed in 1.17.12, 1.18.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.17.12; 1.18.0 to before 1.18.4VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.12; 1.18.0 to before 1.18.4 Vulnerable ·Go standard library

Remediation

  • Fix · CNA encoding/gob (Go standard library) Fixed in 1.17.12, 1.18.4

Red Hat 28 advisories

  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
  • RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 6.1 Container security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
Show 25 more Red Hat advisories
  • RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
  • RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
  • RHSA-2023:1275 Released 2023-03-15 · Red Hat rating Important
    Red Hat OpenStack Platform (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
  • RHSA-2023:1042 Released 2023-03-06 · Red Hat rating Moderate
    Custom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
  • RHSA-2023:0408 Released 2023-01-25 · Red Hat rating Important
    OpenShift Virtualization 4.12.0 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
  • RHSA-2023:0407 Released 2023-01-24 · Red Hat rating Moderate
    OpenShift Virtualization 4.12.0 RPMs security update
    • CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
    • CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
  • RHSA-2022:9047 Released 2022-12-15 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
  • RHSA-2022:8634 Released 2022-11-28 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.1.1 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-velero-rhel8
  • RHSA-2022:8250 Released 2022-11-15 · Red Hat rating Moderate
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-3.2.0-3.el9
  • RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Important
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
  • RHSA-2022:7648 Released 2022-11-08 · Red Hat rating Moderate
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-3.2.0-2.el8
  • RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderate
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
  • RHSA-2022:7129 Released 2022-10-25 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) git-lfs-2.13.3-3.el8_6
  • RHSA-2022:6370 Released 2022-09-06 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2022:6345 Released 2022-09-06 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.1 security updates and bug fixes
    • multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
  • RHSA-2022:6347 Released 2022-09-06 · Red Hat rating Moderate
    VolSync 0.5 security fixes and updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
  • RHSA-2022:6348 Released 2022-09-06 · Red Hat rating Moderate
    Gatekeeper Operator v0.2 security and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/gatekeeper-operator-bundle, rhacm2/gatekeeper-rhel8, rhacm2/gatekeeper-rhel8-operator
  • RHSA-2022:6346 Released 2022-09-06 · Red Hat rating Moderate
    RHSA: Submariner 0.13 - security and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
  • RHSA-2022:6152 Released 2022-09-01 · Red Hat rating Important
    Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2022:6283 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.2 Containers security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/pilot-rhel8 +3
  • RHSA-2022:6040 Released 2022-08-10 · Red Hat rating Important
    Release of OpenShift Serverless 1.24.0
    • Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
  • RHSA-2022:6042 Released 2022-08-10 · Red Hat rating Important
    Release of OpenShift Serverless Client kn 1.24.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
  • RHSA-2022:5866 Released 2022-08-02 · Red Hat rating Important
    go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-1.17.12-1.el7_9, go-toolset-1.17-build-1.17.12-1.el7_9, go-toolset-1.17-golang-1.17.12-1.el7_9 +8
  • RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Important
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
  • RHSA-2022:5775 Released 2022-08-01 · Red Hat rating Important
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.12-1.module+el8.6.0+16014+a372c00b.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet
8Base-OADP-1.1Fixed RHSA-2022:8634
8Base-RHMTC-1.7Fixed RHSA-2022:9047
CNV 4.12 for RHEL 7Fixed RHSA-2023:0407
CNV 4.12 for RHEL 8Fixed RHSA-2023:0407, RHSA-2023:0408
OSSO 1.1 for RHEL 8Fixed RHSA-2022:6152
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2023:1042
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
RHOSSM 2.2 for RHEL 8Fixed RHSA-2022:6283
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:3642
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:5866
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:5775, RHSA-2022:7129, RHSA-2022:7519, RHSA-2022:7648, RHSA-2023:2758, RHSA-2023:2802
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:5799, RHSA-2022:8057, RHSA-2022:8250, RHSA-2023:2357
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:6042
Red Hat OpenShift Serverless 1.24Fixed RHSA-2022:6040
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:1275
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:1275
Not affected: 12 products
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • CNV 4.12 for RHEL 8
  • OSSO 1.1 for RHEL 8
  • OpenShift Custom Metrics Autoscaler 2
  • RHODF 4.13 for RHEL 9
  • RHOSSM 2.2 for RHEL 8
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift distributed tracing 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30635
  2. 2026-10-03 Alias added: GHSA-5fhx-39r8-3jwh

References

Patch 2

Advisory 3

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences