CVE-2022-41715 (GCVE-0-2022-41715)

Vulnerability from cvelistv5 – Published: 2022-10-14 00:00 – Updated: 2025-02-13 16:33
VLAI
Title
Memory exhaustion when compiling regular expressions in regexp/syntax
Summary
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE 400: Uncontrolled Resource Consumption
Assigner
Go CNA under the Google root
CNA scorecard E 42/100 over 75 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Go standard library regexp/syntax Affected: 0 , < 1.18.7 (semver)
Affected: 1.19.0-0 , < 1.19.2 (semver)
guessed Create a notification for this product.
Credits
Adam Korczynski (ADA Logics) OSS-Fuzz
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:49:43.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/55949"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/439356"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-1039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "regexp/syntax",
          "product": "regexp/syntax",
          "programRoutines": [
            {
              "name": "parser.push"
            },
            {
              "name": "parser.repeat"
            },
            {
              "name": "parser.factor"
            },
            {
              "name": "parse"
            },
            {
              "name": "Parse"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.18.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.19.2",
              "status": "affected",
              "version": "1.19.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Korczynski (ADA Logics)"
        },
        {
          "lang": "en",
          "value": "OSS-Fuzz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:09:55.534Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/55949"
        },
        {
          "url": "https://go.dev/cl/439356"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-1039"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Memory exhaustion when compiling regular expressions in regexp/syntax"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-41715",
    "datePublished": "2022-10-14T00:00:00.000Z",
    "dateReserved": "2022-09-28T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:33:07.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-41715",
      "date": "2026-10-12",
      "epss": "0.01726",
      "percentile": "0.76927"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:47:38.000Z",
      "cve": "CVE-2022-41715",
      "id": "msrc_CVE-2022-41715",
      "initial_release_date": "2022-10-19T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Memory exhaustion when compiling regular expressions in regexp/syntax",
      "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-41715.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pkg.go.dev",
                "defaultStatus": "unaffected",
                "packageName": "regexp/syntax",
                "product": "regexp/syntax",
                "programRoutines": [
                  {
                    "name": "parser.push"
                  },
                  {
                    "name": "parser.repeat"
                  },
                  {
                    "name": "parser.factor"
                  },
                  {
                    "name": "parse"
                  },
                  {
                    "name": "Parse"
                  }
                ],
                "vendor": "Go standard library",
                "versions": [
                  {
                    "lessThan": "1.18.7",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.19.2",
                    "status": "affected",
                    "version": "1.19.0-0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@golang.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9CB667C1-EC12-4400-B4F0-6D3B7DDAAD99",
                    "versionEndExcluding": "1.18.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7614AA04-CA34-4ED8-B580-005EA84BD5B4",
                    "versionEndExcluding": "1.19.2",
                    "versionStartIncluding": "1.19.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected."
          },
          {
            "lang": "es",
            "value": "Los programas que compilan expresiones regulares desde fuentes no confiables pueden ser vulnerables al agotamiento de la memoria o a la denegaci\u00f3n de servicio. La representaci\u00f3n de la regexp analizada es lineal en el tama\u00f1o de la entrada, pero en algunos casos el factor constante puede llegar a ser de 40.000, lo que hace que regexps relativamente peque\u00f1as consuman cantidades mucho mayores de memoria. Despu\u00e9s de la correcci\u00f3n, cada regexp que es analizado est\u00e1 limitada a un espacio de memoria de 256 MB. Las expresiones regulares cuya representaci\u00f3n use m\u00e1s espacio que eso son rechazadas. El uso normal de las expresiones regulares no est\u00e1 afectado"
          }
        ],
        "id": "CVE-2022-41715",
        "lastModified": "2026-06-17T05:03:41.893",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-10-14T15:16:20.780",
        "references": [
          {
            "source": "security@golang.org",
            "tags": [
              "Patch"
            ],
            "url": "https://go.dev/cl/439356"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://go.dev/issue/55949"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
          },
          {
            "source": "security@golang.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-1039"
          },
          {
            "source": "security@golang.org",
            "url": "https://security.gentoo.org/glsa/202311-09"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://go.dev/cl/439356"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://go.dev/issue/55949"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Release Notes"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-1039"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "sourceIdentifier": "security@golang.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-12T14:20:13+00:00",
      "cve": "CVE-2022-41715",
      "id": "CVE-2022-41715",
      "initial_release_date": "2022-10-04T00:00:00+00:00",
      "product_status:fixed": "2994",
      "product_status:known_affected": "91",
      "product_status:known_not_affected": "2693",
      "product_status:under_investigation": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "golang: regexp/syntax: limit memory used by parsing regexps",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41715.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.