Panic when decoding Float and Rat types in math/big
Priority MEDIUM 44Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 31 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02781 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial math/big (Go standard library): 1.17.13, 1.18.5Red Hat: 26 advisoriesRed Hat: 18 fixed, 31 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | math/big | before 1.17.13; 1.18.0-0 to before 1.18.5 | 1.17.13, 1.18.5 | Patch available | CNA |
- math/big VendorGo standard library Affected before 1.17.13; 1.18.0-0 to before 1.18.5 Fixed in 1.17.13, 1.18.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.13; 1.18.0 to before 1.18.5 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.13; 1.18.0 to before 1.18.5 Vulnerable ·Go standard library
Remediation
- Fix · CNA math/big (Go standard library) Fixed in 1.17.13, 1.18.5
Red Hat 26 advisories
- RHSA-2026:4128 Released 2026-03-09 · Red Hat rating ImportantRed Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
Show 23 more Red Hat advisories
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:0584 Released 2023-05-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:3205 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:3204 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 RPMs security and bug fix update
- CNV 4.13 for RHEL 7 kubevirt-4.13.0-1469.el7, kubevirt-virtctl-4.13.0-1469.el7, kubevirt-virtctl-redistributable-4.13.0-1469.el7
- CNV 4.13 for RHEL 8 kubevirt-4.13.0-1469.el8, kubevirt-virtctl-4.13.0-1469.el8, kubevirt-virtctl-redistributable-4.13.0-1469.el8
- CNV 4.13 for RHEL 9 kubevirt-4.13.0-1469.el9, kubevirt-virtctl-4.13.0-1469.el9, kubevirt-virtctl-redistributable-4.13.0-1469.el9
- RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
- RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
- RHSA-2023:2236 Released 2023-05-09 · Red Hat rating Moderatetoolbox security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.3-9.el9, toolbox-tests-0.0.99.3-9.el9
- RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
- RHSA-2023:2193 Released 2023-05-09 · Red Hat rating Moderatebutane security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) butane-0.16.0-1.el9
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:1275 Released 2023-03-15 · Red Hat rating ImportantRed Hat OpenStack Platform (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
- RHSA-2023:0693 Released 2023-02-09 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
- RHSA-2023:0542 Released 2023-01-30 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.3.1 Containers security update
- RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4
- RHSA-2023:0446 Released 2023-01-25 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.src::go-toolset:rhel8, delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.x86_64::go-toolset:rhel8, go-toolset-1.18.9-1.module+el8.7.0+17845+708ebe87.aarch64::go-toolset:rhel8 +18
- RHSA-2023:0328 Released 2023-01-23 · Red Hat rating Moderatego-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) golang-1.18.9-1.el9_1, golang-bin-1.18.9-1.el9_1, golang-docs-1.18.9-1.el9_1 +4
- RHSA-2022:7398 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
- Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
- RHSA-2022:8781 Released 2022-12-08 · Red Hat rating ModerateLogging Subsystem 5.5.5 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
- RHSA-2022:8626 Released 2022-11-28 · Red Hat rating ModerateOpenShift Container Platform 4.11.17 packages and security update
- Red Hat OpenShift Container Platform 4.11 cri-o-1.24.3-6.rhaos4.11.gitc4567c0.el8, cri-tools-1.24.2-7.el8, ignition-2.14.0-5.rhaos4.11.el8 +1
- RHSA-2022:8535 Released 2022-11-24 · Red Hat rating ModerateOpenShift Container Platform 4.11.16 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:8534 Released 2022-11-24 · Red Hat rating LowOpenShift Container Platform 4.11.16 security update
- Red Hat OpenShift Container Platform 4.11 butane-0.15.0-3.rhaos4.11.el8, butane-redistributable-0.15.0-3.rhaos4.11.el8
- RHSA-2022:7950 Released 2022-11-15 · Red Hat rating LowImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) weldr-client-35.5-4.el9
- RHSA-2022:7548 Released 2022-11-08 · Red Hat rating LowImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) weldr-client-35.5-4.el8
- RHSA-2022:7129 Released 2022-10-25 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) git-lfs-2.13.3-3.el8_6
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift API for Data Protection | Affected | No fix planned: Out of support scope |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Web Terminal | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix yet: Fix deferred |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:0693 |
| CNV 4.13 for RHEL 7 | Fixed | RHSA-2023:3204 |
| CNV 4.13 for RHEL 8 | Fixed | RHSA-2023:3204 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:3204, RHSA-2023:3205 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:0584 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:8781 |
| RHOSSM 2.3 for RHEL 8 | Fixed | RHSA-2023:0542 |
| Red Hat AI Inference Server 3.2 | Fixed | RHSA-2026:4128 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7129, RHSA-2022:7548, RHSA-2023:0446, RHSA-2023:2758, RHSA-2023:2802 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7950, RHSA-2023:0328, RHSA-2023:2193, RHSA-2023:2236, RHSA-2023:2357 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:8534, RHSA-2022:8535, RHSA-2022:8626 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7398 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1275 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 19 products
- 8Base-RHMTC-1.7
- CNV 4.13 for RHEL 9
- Ironic content for Red Hat OpenShift Container Platform 4.11
- Ironic content for Red Hat OpenShift Container Platform 4.12
- OSSO 1.1 for RHEL 8
- RHODF 4.13 for RHEL 9
- RHOL 5.5 for RHEL 8
- RHOSSM 2.3 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32189
- 2026-10-03 Alias added: GHSA-3rm2-w8f7-h7rf
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-09 Priority changed: LOW → MEDIUM
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-32189 · CVE Program
- CVE-2022-32189 · NVD
- FIRST EPSS
- GHSA-3rm2-w8f7-h7rf · GitHub Advisory Database · CC BY 4.0
- CVE-2022-32189 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences