CoreCVE
Back

HIGH

Stack exhaustion from deeply nested XML documents in encoding/xml

Published Aug 9, 2022

Description

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Affected products

Remediation

Red Hat statement

The vulnerability exists in the calling of the function decoder.skip to a deeply nested XML document. Although the vulnerability exists, it may require that the application accept deeply nested XML from untrusted sources and specifically calls Decoder.Skip on it. In many deployments, that code path might not even be reachable or exposed to external input. On top of that, a successful exploitation will only result in denial of service due to stack exhaustion, which is why this has been marked as moderate by Red Hat.

Metrics

Weaknesses (2)

CWE-1325

CWE-674

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Go
Published Aug 9, 2022
Updated Aug 3, 2024
Reserved Mar 29, 2022
Link CVE-2022-28131
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-28131
Red Hat
Severity Moderate
Public date Jul 12, 2022
Links CVE-2022-28131 - Bugzilla