Memory exhaustion when compiling regular expressions in regexp/syntax
Priority LOW 36Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 28 fixed, 28 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.
Why it matters now
EPSS 0.01726 77th percentileScored 2026-11-07
Fix Partial regexp/syntax (Go standard library): 1.18.7, 1.19.2Red Hat: 36 advisoriesRed Hat: 28 fixed, 28 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | regexp/syntax | before 1.18.7; 1.19.0-0 to before 1.19.2 | 1.18.7, 1.19.2 | Patch available | CNA |
- regexp/syntax VendorGo standard library Affected before 1.18.7; 1.19.0-0 to before 1.19.2 Fixed in 1.18.7, 1.19.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.18.7; 1.19.0 to before 1.19.2 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.18.7; 1.19.0 to before 1.19.2 Vulnerable ·Go standard library
Remediation
- Fix · CNA regexp/syntax (Go standard library) Fixed in 1.18.7, 1.19.2
Red Hat 36 advisories
- RHSA-2024:3254 Released 2024-05-22 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
Show 33 more Red Hat advisories
- RHSA-2024:2586 Released 2024-04-30 · Red Hat rating Moderatecontainer-tools:3.0 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) buildah-1.19.9-1.module+el8.4.0+21529+674bace2.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21529+674bace2.x86_64::container-tools:3.0, buildah-tests-1.19.9-1.module+el8.4.0+21529+674bace2.x86_64::container-tools:3.0 +40
- Red Hat Enterprise Linux AppStream E4S (v.8.4) buildah-1.19.9-1.module+el8.4.0+21529+674bace2.ppc64le::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21529+674bace2.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21529+674bace2.x86_64::container-tools:3.0 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) buildah-1.19.9-1.module+el8.4.0+21529+674bace2.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21529+674bace2.x86_64::container-tools:3.0, buildah-tests-1.19.9-1.module+el8.4.0+21529+674bace2.x86_64::container-tools:3.0 +40
- RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderatecontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3613 Released 2023-06-26 · Red Hat rating ModerateOpenShift Container Platform 4.12.22 packages and security update
- Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:0584 Released 2023-05-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:3205 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:2780 Released 2023-05-16 · Red Hat rating ModerateImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-75-1.el8, osbuild-composer-core-75-1.el8, osbuild-composer-dnf-json-75-1.el8 +2
- RHSA-2023:2784 Released 2023-05-16 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-4.el8
- RHSA-2023:2866 Released 2023-05-16 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) git-lfs-3.2.0-2.el8
- RHSA-2023:2204 Released 2023-05-09 · Red Hat rating ModerateImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-76-2.el9_2, osbuild-composer-core-76-2.el9_2, osbuild-composer-dnf-json-76-2.el9_2 +2
- RHSA-2023:2592 Released 2023-05-09 · Red Hat rating Moderategolang-github-cpuguy83-md2man security, bug fix, and enhancement update
- Red Hat Enterprise Linux CRB (v. 9) golang-github-cpuguy83-md2man-2.0.2-4.el9
- RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
- RHSA-2023:2167 Released 2023-05-09 · Red Hat rating Moderategrafana security and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-9.0.9-2.el9
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:1275 Released 2023-03-15 · Red Hat rating ImportantRed Hat OpenStack Platform (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
- RHSA-2023:1174 Released 2023-03-09 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.2 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
- RHSA-2023:1042 Released 2023-03-06 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
- RHSA-2023:1079 Released 2023-03-06 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2 (osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container) security update
- Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
- RHSA-2023:0727 Released 2023-02-16 · Red Hat rating ModerateOpenShift Container Platform 4.12.3 security update
- Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-4.rhaos4.12.el8, buildah-1:1.23.4-4.rhaos4.12.el9, buildah-tests-1:1.23.4-4.rhaos4.12.el8 +45
- RHSA-2023:0709 Released 2023-02-09 · Red Hat rating ModerateRelease of OpenShift Serverless 1.27.0
- Red Hat OpenShift Serverless 1.27 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:0708 Released 2023-02-09 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.27.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.6.1-1.el8
- RHSA-2023:0693 Released 2023-02-09 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
- RHSA-2023:0542 Released 2023-01-30 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.3.1 Containers security update
- RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4
- RHSA-2023:0446 Released 2023-01-25 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.src::go-toolset:rhel8, delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.x86_64::go-toolset:rhel8, go-toolset-1.18.9-1.module+el8.7.0+17845+708ebe87.aarch64::go-toolset:rhel8 +18
- RHSA-2023:0445 Released 2023-01-25 · Red Hat rating Moderatego-toolset-1.18 security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.18-1.18.9-1.el7_9, go-toolset-1.18-build-1.18.9-1.el7_9, go-toolset-1.18-golang-1.18.9-1.el7_9 +8
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.18-1.18.9-1.el7_9, go-toolset-1.18-build-1.18.9-1.el7_9, go-toolset-1.18-golang-1.18.9-1.el7_9 +8
- RHSA-2023:0328 Released 2023-01-23 · Red Hat rating Moderatego-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) golang-1.18.9-1.el9_1, golang-bin-1.18.9-1.el9_1, golang-docs-1.18.9-1.el9_1 +4
- RHSA-2023:0264 Released 2023-01-19 · Red Hat rating ModerateRed Hat OpenShift (Logging Subsystem) security update
- RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
- RHSA-2022:7399 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:7398 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
- Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
- RHSA-2022:8781 Released 2022-12-08 · Red Hat rating ModerateLogging Subsystem 5.5.5 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
- RHSA-2022:8535 Released 2022-11-24 · Red Hat rating ModerateOpenShift Container Platform 4.11.16 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Web Terminal | Affected | No fix yet: Fix deferred |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:1174 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:0693 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:3205 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:0584 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2023:1042 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:8781 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2023:0264 |
| RHOSSM 2.3 for RHEL 8 | Fixed | RHSA-2023:0542 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:0445 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:0445 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:0446, RHSA-2023:2780, RHSA-2023:2784, RHSA-2023:2866, RHSA-2024:0121, RHSA-2024:2988, RHSA-2024:3254 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:0328, RHSA-2023:2167, RHSA-2023:2204, RHSA-2023:2357 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:2586 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:2586 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:2586 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:2592 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:8535 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7398, RHSA-2022:7399, RHSA-2023:0727, RHSA-2023:3613 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:0708 |
| Red Hat OpenShift Serverless 1.27 | Fixed | RHSA-2023:0709 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1079, RHSA-2023:1275 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 23 products
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- Ironic content for Red Hat OpenShift Container Platform 4.12
- Middleware Containers for OpenShift
- OSSO 1.1 for RHEL 8
- OpenShift Custom Metrics Autoscaler 2
- RHODF 4.13 for RHEL 9
- RHOL 5.5 for RHEL 8
- RHOL 5.6 for RHEL 8
- RHOSSM 2.3 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenStack Platform 16.2
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41715
- 2026-10-03 Alias added: GHSA-5wvm-rxcf-6cg8
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-41715 · CVE Program
- CVE-2022-41715 · NVD
- FIRST EPSS
- GHSA-5wvm-rxcf-6cg8 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-41715 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences