« Volver al listado

CVE-2022-41715

Estado: ModificadaAlta (7.5)—

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Golang — GO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-41715",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "regexp/syntax",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.18.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.19.0-0",
              "lessThan": "1.19.2",
              "versionType": "semver"
            }
          ],
          "packageName": "regexp/syntax",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "parser.push"
            },
            {
              "name": "parser.repeat"
            },
            {
              "name": "parser.factor"
            },
            {
              "name": "parse"
            },
            {
              "name": "Parse"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-14T15:16:20.780",
  "references": [
    {
      "url": "https://go.dev/cl/439356",
      "tags": [
        "Patch"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/55949",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU",
      "tags": [
        "Mailing List",
        "Release Notes"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-1039",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/202311-09",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/cl/439356",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://go.dev/issue/55949",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU",
      "tags": [
        "Mailing List",
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-1039",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202311-09",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected."
    },
    {
      "lang": "es",
      "value": "Los programas que compilan expresiones regulares desde fuentes no confiables pueden ser vulnerables al agotamiento de la memoria o a la denegación de servicio. La representación de la regexp analizada es lineal en el tamaño de la entrada, pero en algunos casos el factor constante puede llegar a ser de 40.000, lo que hace que regexps relativamente pequeñas consuman cantidades mucho mayores de memoria. Después de la corrección, cada regexp que es analizado está limitada a un espacio de memoria de 256 MB. Las expresiones regulares cuya representación use más espacio que eso son rechazadas. El uso normal de las expresiones regulares no está afectado"
    }
  ],
  "lastModified": "2026-06-17T05:03:41.893",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CB667C1-EC12-4400-B4F0-6D3B7DDAAD99",
              "versionEndExcluding": "1.18.7"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7614AA04-CA34-4ED8-B580-005EA84BD5B4",
              "versionEndExcluding": "1.19.2",
              "versionStartIncluding": "1.19.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}