Vulnerability-Lookup

CVE-2022-30632 (GCVE-0-2022-30632)

Vulnerability from cvelistv5 – Published: 2022-08-09 20:15 – Updated: 2024-08-03 06:56

Title

Stack exhaustion on crafted paths in path/filepath

Summary

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/cl/417066
https://go.googlesource.com/go/+/ac68c6c683409f98…
https://go.dev/issue/53416
https://groups.google.com/g/golang-announce/c/nqr…
https://pkg.go.dev/vuln/GO-2022-0522

Impacted products

1 product

Vendor	Product	Version	CPE status
Go standard library	path/filepath	Affected: 0 , < 1.17.12 (semver) Affected: 1.18.0-0 , < 1.18.4 (semver)	guessed

Credits

Juho Nurminen of Mattermost

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:56:13.251Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/417066"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/53416"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0522"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "path/filepath",
          "product": "path/filepath",
          "programRoutines": [
            {
              "name": "Glob"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.17.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.18.4",
              "status": "affected",
              "version": "1.18.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-12T19:04:36.688Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/417066"
        },
        {
          "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
        },
        {
          "url": "https://go.dev/issue/53416"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-0522"
        }
      ],
      "title": "Stack exhaustion on crafted paths in path/filepath"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-30632",
    "datePublished": "2022-08-09T20:15:37.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T06:56:13.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-30632",
      "date": "2026-09-18",
      "epss": "0.01939",
      "percentile": "0.79197"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:54:37.000Z",
      "cve": "CVE-2022-30632",
      "id": "msrc_CVE-2022-30632",
      "initial_release_date": "2022-08-16T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Stack exhaustion on crafted paths in path/filepath",
      "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-30632.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pkg.go.dev",
                "defaultStatus": "unaffected",
                "packageName": "path/filepath",
                "product": "path/filepath",
                "programRoutines": [
                  {
                    "name": "Glob"
                  }
                ],
                "vendor": "Go standard library",
                "versions": [
                  {
                    "lessThan": "1.17.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.18.4",
                    "status": "affected",
                    "version": "1.18.0-0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@golang.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "646881F6-A299-4D92-A1F3-E95959FA426F",
                    "versionEndExcluding": "1.17.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE088A2D-7894-4A48-887C-36DD727A7BEB",
                    "versionEndExcluding": "1.18.4",
                    "versionStartIncluding": "1.18.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators."
          },
          {
            "lang": "es",
            "value": "Una recursi\u00f3n no controlada en Glob en path/filepath versiones anteriores a Go 1.17.12 y Go 1.18.4, permite a un atacante causar un p\u00e1nico debido al agotamiento de la pila por medio de una ruta que contenga un gran n\u00famero de separadores de ruta"
          }
        ],
        "id": "CVE-2022-30632",
        "lastModified": "2026-06-17T04:43:59.057",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-08-10T20:15:41.877",
        "references": [
          {
            "source": "security@golang.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://go.dev/cl/417066"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://go.dev/issue/53416"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Mailing List",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0522"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://go.dev/cl/417066"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://go.dev/issue/53416"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-0522"
          }
        ],
        "sourceIdentifier": "security@golang.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T12:43:21+00:00",
      "cve": "CVE-2022-30632",
      "id": "CVE-2022-30632",
      "initial_release_date": "2022-07-12T00:00:00+00:00",
      "product_status:fixed": "1091",
      "product_status:known_affected": "81",
      "product_status:known_not_affected": "164",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "golang: path/filepath: stack exhaustion in Glob",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-30632.json",
      "version": "3"
    }
  }
}

OESA-2022-1783 (CVE-2022-32148)

Vulnerability from osv_openeuler – Published: 2022-07-29 11:05 – Updated: 2026-08-06 11:05 – Source website

Summary

golang security update

Details

The Go Programming Language

Security Fix(es):

When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.(CVE-2022-32148)

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.(CVE-2022-30635)

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

Calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.(CVE-2022-30633)

Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.(CVE-2022-30632)

Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.(CVE-2022-30631)

As required by RFC 8446, section 4.6.1, ticket_age_add now holds arandom 32-bit value. Before this change, this value was always setto 0.(CVE-2022-30629)

Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.(CVE-2022-28131)

Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.(CVE-2022-1962)

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a chunked encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.(CVE-2022-1705)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-32148	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30635	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30634	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30633	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30632	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30631	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-30629	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-28131	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-1962	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-1705	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "golang-1.15.7-14.oe1.aarch64.rpm"
        ],
        "noarch": [
          "golang-devel-1.15.7-14.oe1.noarch.rpm",
          "golang-help-1.15.7-14.oe1.noarch.rpm"
        ],
        "src": [
          "golang-1.15.7-14.oe1.src.rpm"
        ],
        "x86_64": [
          "golang-1.15.7-14.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "golang",
        "purl": "pkg:rpm/openEuler/golang\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.7-14.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "golang-1.15.7-14.oe1.aarch64.rpm"
        ],
        "noarch": [
          "golang-devel-1.15.7-14.oe1.noarch.rpm",
          "golang-help-1.15.7-14.oe1.noarch.rpm"
        ],
        "src": [
          "golang-1.15.7-14.oe1.src.rpm"
        ],
        "x86_64": [
          "golang-1.15.7-14.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP3",
        "name": "golang",
        "purl": "pkg:rpm/openEuler/golang\u0026distro=openEuler-20.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.7-14.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "golang-1.17.3-5.oe2203.aarch64.rpm"
        ],
        "noarch": [
          "golang-devel-1.17.3-5.oe2203.noarch.rpm",
          "golang-help-1.17.3-5.oe2203.noarch.rpm"
        ],
        "src": [
          "golang-1.17.3-5.oe2203.src.rpm"
        ],
        "x86_64": [
          "golang-1.17.3-5.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "golang",
        "purl": "pkg:rpm/openEuler/golang\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.3-5.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Go Programming Language\r\n\r\nSecurity Fix(es):\r\n\r\nWhen httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.(CVE-2022-32148)\n\nCalling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.(CVE-2022-30635)\n\nInfinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u0026lt;\u0026lt; 32 - 1 bytes. (CVE-2022-30634)\n\nCalling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.(CVE-2022-30633)\n\nCalling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.(CVE-2022-30632)\n\nCalling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.(CVE-2022-30631)\n\nAs required by RFC 8446, section 4.6.1, ticket_age_add now holds arandom 32-bit value. Before this change, this value was always setto 0.(CVE-2022-30629)\n\nCalling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.(CVE-2022-28131)\n\nCalling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.(CVE-2022-1962)\n\nThe HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a chunked encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.(CVE-2022-1705)",
  "id": "OESA-2022-1783",
  "modified": "2026-08-06T11:05:03Z",
  "published": "2022-07-29T11:05:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1783"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32148"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30635"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30634"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30633"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30632"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30629"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28131"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1962"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "golang security update",
  "upstream": [
    "CVE-2022-32148",
    "CVE-2022-30635",
    "CVE-2022-30634",
    "CVE-2022-30633",
    "CVE-2022-30632",
    "CVE-2022-30631",
    "CVE-2022-30629",
    "CVE-2022-28131",
    "CVE-2022-1962",
    "CVE-2022-1705"
  ]
}

OPENSUSE-SU-2024:12189-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

go1.17-1.17.12-1.1 on GA media

Severity

Moderate

Scope

9 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 12 products

Open the full advisory

OPENSUSE-SU-2024:12190-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

go1.18-1.18.4-1.1 on GA media

Severity

Moderate

Scope

9 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 12 products

Open the full advisory

RHSA-2022:5775

Vulnerability from csaf_redhat - Published: 2022-08-01 12:10 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 23 products

https://access.redhat.com/errata/RHSA-2022:5775

Open the full advisory

RHSA-2022:5799

Vulnerability from csaf_redhat - Published: 2022-08-01 16:07 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: go-toolset and golang security and bug fix update

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 14 products Known not affected: 5 products

https://access.redhat.com/errata/RHSA-2022:5799

Open the full advisory

RHSA-2022:5866

Vulnerability from csaf_redhat - Published: 2022-08-02 09:56 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 26 products Known not affected: 18 products

https://access.redhat.com/errata/RHSA-2022:5866

Open the full advisory

RHSA-2022:6040

Vulnerability from csaf_redhat - Published: 2022-08-10 13:13 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: Release of OpenShift Serverless 1.24.0

Severity

Important

Scope

15 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 112 products

https://access.redhat.com/errata/RHSA-2022:6040

Open the full advisory

RHSA-2022:6042

Vulnerability from csaf_redhat - Published: 2022-08-10 11:39 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.24.0

Severity

Important

Scope

15 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2022:6042

Open the full advisory

RHSA-2022:6113

Vulnerability from csaf_redhat - Published: 2022-08-18 15:12 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: Red Hat Application Interconnect 1.0 Release (rpms)

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2022:6113

Open the full advisory

RHSA-2022:6152

Vulnerability from csaf_redhat - Published: 2022-09-01 05:40 - Updated: 2026-09-18 11:41

Summary

Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2022-30632.

CVE-2022-30632

A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product Known not affected: 1 product

https://access.redhat.com/errata/RHSA-2022:6152

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-30632 (GCVE-0-2022-30632)

OESA-2022-1783 (CVE-2022-32148)

Tags

Sightings

Nomenclature

Related by attack behaviour