Infinite loop in parsing in go/scanner
Priority LOW 36CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 22 fixed, 27 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01412 72nd percentileScored 2026-11-07
Fix Partial go/scanner (Go standard library): 1.19.8, 1.20.3Red Hat: 28 advisoriesRed Hat: 22 fixed, 27 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | go/scanner | before 1.19.8; 1.20.0-0 to before 1.20.3 | 1.19.8, 1.20.3 | Patch available | CNA |
- go/scanner VendorGo standard library Affected before 1.19.8; 1.20.0-0 to before 1.20.3 Fixed in 1.19.8, 1.20.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.19.8; 1.20.0 to before 1.20.3 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.19.8; 1.20.0 to before 1.20.3 Vulnerable ·Go standard library
Remediation
- Fix · CNA go/scanner (Go standard library) Fixed in 1.19.8, 1.20.3
Red Hat 28 advisories
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
- RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
- RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
Show 25 more Red Hat advisories
- RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderatepodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
- RHSA-2023:6363 Released 2023-11-07 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-1.el9, skopeo-tests-2:1.13.3-1.el9
- RHSA-2023:5964 Released 2023-10-20 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2.5 (collectd-libpod-stats) security update
- Red Hat OpenStack Platform 16.2 collectd-libpod-stats-1.0.4-5.el8ost
- RHSA-2023:4986 Released 2023-09-06 · Red Hat rating ModerateRed Hat OpenShift Distributed Tracing 2.9.0 security update
- Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
- RHSA-2023:4657 Released 2023-08-23 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.2 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:4664 Released 2023-08-16 · Red Hat rating ImportantOpenShift Virtualization 4.13.3 Images security and bug fix update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
- RHSA-2023:4470 Released 2023-08-03 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
- RHSA-2023:4093 Released 2023-07-20 · Red Hat rating ImportantOpenShift Container Platform 4.13.5 security update
- Red Hat OpenShift Container Platform 4.13 openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, openshift-clients-4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 +5
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3943 Released 2023-06-29 · Red Hat rating ModerateACS 4.1 enhancement and security update
- RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
- RHSA-2023:3918 Released 2023-06-29 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-rhel8
- RHSA-2023:3612 Released 2023-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.13.4 packages and security update
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.18.1.el9_2, buildah-1:1.29.1-2.1.rhaos4.13.el9, buildah-1:1.29.1-2.rhaos4.13.el8 +47
- RHSA-2023:3624 Released 2023-06-15 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.10 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-velero-plugin-rhel8
- RHSA-2023:3540 Released 2023-06-13 · Red Hat rating ModerateOpenShift Container Platform 4.13.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 microshift-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9, microshift-networking-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9, microshift-release-info-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9 +1
- RHSA-2023:3536 Released 2023-06-13 · Red Hat rating ImportantOpenShift Container Platform 4.13.3 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 python-flask-2:2.0.1-4.el9.2, python-flask-doc-2:2.0.1-4.el9.2, python3-flask-2:2.0.1-4.el9.2
- Red Hat OpenShift Container Platform 4.13 NetworkManager-1:1.42.2-2.el9_2, NetworkManager-adsl-1:1.42.2-2.el9_2, NetworkManager-bluetooth-1:1.42.2-2.el9_2 +28
- RHSA-2023:3366 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.2 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-api-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-common-1:21.3.1-0.20230510075528.b3c902e.el9 +3
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.16.1.el9_2, buildah-1:1.29.1-1.1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.1.rhaos4.13.el9 +47
- RHSA-2023:3367 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:3455 Released 2023-06-05 · Red Hat rating ModerateRelease of OpenShift Serverless 1.29.0
- Red Hat OpenShift Serverless 1.29 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:3445 Released 2023-06-05 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-14.el8ost
- RHSA-2023:3450 Released 2023-06-05 · Red Hat rating ModerateOpenShift Serverless Client kn 1.29.0 release
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.8.1-3.el8
- RHSA-2023:3323 Released 2023-05-25 · Red Hat rating Importantgo-toolset-1.19 and go-toolset-1.19-golang security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.9-1.el7_9, go-toolset-1.19-golang-bin-1.19.9-1.el7_9, go-toolset-1.19-golang-docs-1.19.9-1.el7_9 +4
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.9-1.el7_9, go-toolset-1.19-golang-bin-1.19.9-1.el7_9, go-toolset-1.19-golang-docs-1.19.9-1.el7_9 +4
- RHSA-2023:3319 Released 2023-05-25 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.9-1.module+el8.8.0+18857+fca43658.aarch64::go-toolset:rhel8 +18
- RHSA-2023:3318 Released 2023-05-25 · Red Hat rating Importantgo-toolset and golang security update
- Red Hat Enterprise Linux AppStream (v. 9) golang-1.19.9-2.el9_2, golang-bin-1.19.9-2.el9_2, golang-docs-1.19.9-2.el9_2 +4
- RHSA-2023:3167 Released 2023-05-18 · Red Hat rating ModerateRed Hat build of Cryostat 2.3.0: new RHEL 8 container images
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix planned: Out of support scope |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.4 | Fixed | — |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:3918 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:3624 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:4664 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2023:3167 |
| Ironic content for Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:3366, RHSA-2023:3536 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:4657 |
| Quay v3 | Fixed | — |
| RHACS 4.1 for RHEL 8 | Fixed | RHSA-2023:3943 |
| Red Hat Ansible Automation Platform 2.3 for RHEL 8 | Fixed | RHSA-2023:4470 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:3323 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:3323 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:3319, RHSA-2023:6938, RHSA-2023:6939 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:3318, RHSA-2023:6363, RHSA-2023:6474 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:3366, RHSA-2023:3367, RHSA-2023:3536, RHSA-2023:3540, RHSA-2023:3612, RHSA-2023:4093 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:3450 |
| Red Hat OpenShift Serverless 1.29 | Fixed | RHSA-2023:3455 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:3445, RHSA-2023:5964 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
Not affected: 23 products
- 8Base-MTV-2.4
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.13 for RHEL 9
- Custom Metric Autoscaler operator for Red Hat Openshift
- Ironic content for Red Hat OpenShift Container Platform 4.13
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- Middleware Containers for OpenShift
- OSSO 1.1 for RHEL 8
- RHACS 4.1 for RHEL 8
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
- Service Telemetry Framework 1.5
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24537
- 2026-10-03 Alias added: GHSA-fp86-2355-v99r
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-24537 · CVE Program
- CVE-2023-24537 · NVD
- FIRST EPSS
- GHSA-fp86-2355-v99r · GitHub Advisory Database · CC BY 4.0
- CVE-2023-24537 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences