p PatchFirst

CVE-2022-41715

CVE-2022-41715 · Memory exhaustion when compiling regular expressions in regexp/syntax

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

CVSS 7.5 · High · EPSS 1.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • regexp/syntax

    Versions
    • ≥ 0, < 1.18.7: Affected (semver)
    • ≥ 1.19.0-0, < 1.19.2: Affected (semver)

    Update to 1.18.7; Update to 1.19.2

  • golang-1.19 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.19.2-1

    Update to 1.19.2-1

  • golang-1.10 Ubuntu:14.04:LTS

    Versions
    • 1.10.4-2ubuntu1~14.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:16.04:LTS

    Versions
    • 1.10.4-2ubuntu1~16.04.1
    • 1.10.4-2ubuntu1~16.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.6 Ubuntu:16.04:LTS

    Versions
    • 1.6-0ubuntu1
    • 1.6-0ubuntu2
    • 1.6-0ubuntu3
    • 1.6-0ubuntu4
    • 1.6-0ubuntu5
    • 1.6.1-0ubuntu1
    • 1.6.2-0ubuntu5~16.04
    • 1.6.2-0ubuntu5~16.04.2
    • 1.6.2-0ubuntu5~16.04.3
    • 1.6.2-0ubuntu5~16.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.8-1ubuntu1~16.04.2
    • 1.13.8-1ubuntu1~16.04.3
    • 1.13.8-1ubuntu1~16.04.3+esm2
    • 1.13.8-1ubuntu1~16.04.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:18.04:LTS

    Versions
    • 1.18.1-1ubuntu1~18.04.3
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1~18.04.4

    Update to 1.18.1-1ubuntu1~18.04.4

  • golang-1.10 Ubuntu:18.04:LTS

    Versions
    • 1.10~rc1-1
    • 1.10~rc1-1ubuntu1
    • 1.10~rc1-2ubuntu1
    • 1.10~rc2-1ubuntu1
    • 1.10-1ubuntu1
    • 1.10.1-1ubuntu2
    • 1.10.4-2ubuntu1~18.04.1
    • 1.10.4-2ubuntu1~18.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.13.8-1ubuntu1~18.04.2
    • 1.13.8-1ubuntu1~18.04.3
    • 1.13.8-1ubuntu1~18.04.4
    • 1.13.8-1ubuntu1~18.04.4+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.16 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.16.2-0ubuntu1~18.04.2
    • 1.16.2-0ubuntu1~18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.8 Ubuntu:18.04:LTS

    Versions
    • 1.8.3-2ubuntu1
    • 1.8.3-2ubuntu1.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.9 Ubuntu:18.04:LTS

    Versions
    • 1.9.1-2ubuntu1
    • 1.9.2-1ubuntu1
    • 1.9.2-3ubuntu1
    • 1.9.3-1ubuntu1
    • 1.9.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:20.04:LTS

    Versions
    • 1.18.1-1ubuntu1~20.04.1
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1~20.04.2

    Update to 1.18.1-1ubuntu1~20.04.2

  • golang-1.13 Ubuntu:20.04:LTS

    Versions
    • 1.13.1-1ubuntu1
    • 1.13.3-1ubuntu1
    • 1.13.4-1ubuntu1
    • 1.13.5-1ubuntu1
    • 1.13.6-1ubuntu1
    • 1.13.6-2ubuntu1
    • 1.13.7-1ubuntu1
    • 1.13.8-1ubuntu1
    • 1.13.8-1ubuntu1.1
    • 1.13.8-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.14 Ubuntu:20.04:LTS

    Versions
    • 1.14~beta1-1
    • 1.14~beta1-2
    • 1.14~rc1-1
    • 1.14-1
    • 1.14.1-1
    • 1.14.2-1
    • 1.14.2-1ubuntu1
    • 1.14.3-2ubuntu2~20.04.1
    • 1.14.3-2ubuntu2~20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.16 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.16.2-0ubuntu1~20.04
    • 1.16.2-0ubuntu1~20.04.1
    • 1.16.2-0ubuntu1~20.04.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:22.04:LTS

    Versions
    • 1.18~beta1-0ubuntu1
    • 1.18~beta2-1ubuntu1
    • 1.18~beta2-1ubuntu2
    • 1.18~rc1-1ubuntu1
    • 1.18-1ubuntu1
    • 1.18.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1.1

    Update to 1.18.1-1ubuntu1.1

  • golang-1.13 Ubuntu:Pro:22.04:LTS

    Versions
    • 1.13.8-1ubuntu2
    • 1.13.8-1ubuntu2.22.04.1
    • 1.13.8-1ubuntu2.22.04.1+esm1
    • 1.13.8-1ubuntu2.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →