GO-2021-0347
Stack exhaustion when compiling deeply nested expressions in regexp
At a glance
- Published
- Updated
- CVE
- CVE-2022-24921
- Aliases
- BIT-golang-2022-24921
Description
On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.16.15, introduced 1.17.0-0, fixed 1.17.8 |
References
- https://go.dev/cl/384616 FIX
- https://go.googlesource.com/go/+/452f24ae94f38afa3704d4361d91d51218405c0a FIX
- https://go.dev/issue/51112 REPORT
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |