Read the docs
TI-2022-13882 Aliases CVE-2022-32149GHSA-69ch-w2m2-3vjp

Denial of service via crafted Accept-Language header in golang.org/x/text/language

Priority MEDIUM 43CWE-772Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 12 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-772.

Summary

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01841 79th percentileScored 2026-11-07
Fix Partial golang.org/x/text/language (golang.org/x/text): 0.3.8golang.org/x/text (Go): 0.3.8Red Hat: 14 advisoriesRed Hat: 14 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
golang.org/x/textgolang.org/x/text/languagebefore 0.3.80.3.8Patch availableCNA
—golang.org/x/text (Go)before 0.3.80.3.8Patch availableGHSA-69ch-w2m2-3vjp
  • golang.org/x/text/language Vendorgolang.org/x/text Affected before 0.3.8 Fixed in 0.3.8 Patch available CNA
  • golang.org/x/text (Go) Vendor— Affected before 0.3.8 Fixed in 0.3.8 Patch available GHSA-69ch-w2m2-3vjp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:text:*:*:*:*:*:*:*:*before 0.3.8VulnerableGo standard library

Remediation

  • Fix · CNA golang.org/x/text/language (golang.org/x/text) Fixed in 0.3.8
  • Fix · GHSA-69ch-w2m2-3vjp golang.org/x/text (Go) Fixed in 0.3.8 Advisory →

Red Hat 14 advisories

  • RHSA-2024:2077 Released 2024-04-29 · Red Hat rating Important
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.s390x::container-tools:rhel8 +47
  • RHSA-2024:1994 Released 2024-04-23 · Red Hat rating Moderate
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+21266+3e24c7b3.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+21266+3e24c7b3.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+21266+3e24c7b3.s390x::container-tools:rhel8 +47
  • RHSA-2023:3613 Released 2023-06-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.22 packages and security update
    • Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
Show 11 more Red Hat advisories
  • RHSA-2023:3205 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
  • RHSA-2023:3204 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.0 RPMs security and bug fix update
    • CNV 4.13 for RHEL 7 kubevirt-4.13.0-1469.el7, kubevirt-virtctl-4.13.0-1469.el7, kubevirt-virtctl-redistributable-4.13.0-1469.el7
    • CNV 4.13 for RHEL 8 kubevirt-4.13.0-1469.el8, kubevirt-virtctl-4.13.0-1469.el8, kubevirt-virtctl-redistributable-4.13.0-1469.el8
    • CNV 4.13 for RHEL 9 kubevirt-4.13.0-1469.el9, kubevirt-virtctl-4.13.0-1469.el9, kubevirt-virtctl-redistributable-4.13.0-1469.el9
  • RHSA-2023:1042 Released 2023-03-06 · Red Hat rating Moderate
    Custom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
  • RHSA-2023:0795 Released 2023-02-15 · Red Hat rating Moderate
    RHSA: Submariner 0.13.3 - security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
  • RHSA-2023:0693 Released 2023-02-09 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
  • RHSA-2023:0692 Released 2023-02-09 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.0.7 security and bug fix update
    • 8Base-OADP-1.0 oadp/oadp-registry-rhel8, oadp/oadp-velero-rhel8
  • RHSA-2023:0481 Released 2023-01-26 · Red Hat rating Moderate
    Submariner 0.12.3 - security update and bug fix
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/subctl-rhel8 +6
  • RHSA-2022:7435 Released 2022-11-16 · Red Hat rating Moderate
    Logging Subsystem 5.4.8 - Red Hat OpenShift security update
    • RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +1
  • RHSA-2022:7434 Released 2022-11-10 · Red Hat rating Moderate
    Logging Subsystem 5.5.4 - Red Hat OpenShift security update
    • RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-proxy-rhel8
  • RHSA-2022:6882 Released 2022-11-09 · Red Hat rating Moderate
    Openshift Logging 5.3.13 security and bug fix release
    • OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8
  • RHSA-2022:7407 Released 2022-11-03 · Red Hat rating Moderate
    Service Binding Operator 1.3.1 security update
    • OpenShift Developer Tools and Services for OCP 4.9 for RHEL 8 ocp-tools-4/service-binding-operator-bundle, ocp-tools-4/service-binding-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform Assisted Installer 1AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Self Node Remediation OperatorAffectedNo fix yet
8Base-OADP-1.0Fixed RHSA-2023:0692
8Base-RHMTC-1.7Fixed RHSA-2023:0693
CNV 4.13 for RHEL 7Fixed RHSA-2023:3204
CNV 4.13 for RHEL 8Fixed RHSA-2023:3204
CNV 4.13 for RHEL 9Fixed RHSA-2023:3204, RHSA-2023:3205
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2023:1042
OpenShift Developer Tools and Services for OCP 4.9 for RHEL 8Fixed RHSA-2022:7407
OpenShift Logging 5.3Fixed RHSA-2022:6882
Quay v3Fixed—
RHOL 5.4 for RHEL 8Fixed RHSA-2022:7435
RHOL 5.5 for RHEL 8Fixed RHSA-2022:7434
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:1994
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:2077
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:3613
Not affected: 11 products
  • 8Base-OADP-1.0
  • 8Base-RHMTC-1.7
  • CNV 4.13 for RHEL 9
  • Migration Toolkit for Virtualization
  • OpenShift Custom Metrics Autoscaler 2
  • OpenShift Logging 5.3
  • RHOL 5.4 for RHEL 8
  • RHOL 5.5 for RHEL 8
  • Red Hat Advanced Cluster Security 3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-32149
  2. 2026-10-03 Alias added: GHSA-69ch-w2m2-3vjp

References

Advisory 5

Other 4

  • TI-2026-69257 Panic in golang.org/x/text Nickname profile parsing crafted input CVSS 3.1HIGH 7.5
  • TI-2026-40992 Infinite loop on invalid input in golang.org/x/text CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences