Skip to content
Fencer Vulns
high 7.5

CVE-2022-24921 json

Stack exhaustion when compiling deeply nested expressions in regexp

published 2022-03-05 4 y ago modified 2026-10-16 24 d ago also BIT-golang-2022-24921 , EUVD-2022-29676 , GO-2021-0347

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

Patch / fix

  • bitnami golang 1.16.15, 1.17.8
  • go stdlib 1.16.15, 1.17.8
  • golang go 1.16.15, 1.17.8
  • golang-1.15 Debian 11 1.15.15-1~deb11u4

debian advisories DEBIAN-CVE-2022-24921

  • delve RHEL 8 1.7.2-1.module+el8.6.0+12972+ebab5911
  • golang RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db
  • go-toolset RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db
  • golang-bin RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db
  • golang-src RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db
  • golang-misc RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db
  • golang-race RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db
  • golang-tests RHEL 8 1.17.10-1.module+el8.6.0+15486+6d4da7db

red hat advisories RHSA-2022:5337RHSA-2023:0407RHSA-2022:6277RHSA-2022:6042RHSA-2022:5068RHSA-2022:5799

  • go1.17 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 1.17.8-150000.1.25.1
  • go1.16 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 1.16.15-150000.1.46.1

suse advisories SUSE-SU-2022:1167-1SUSE-SU-2022:1164-1

  • go1.16 openSUSE Tumbleweed 1.16.15-1.1
  • go1.17 openSUSE Tumbleweed 1.17.8-1.1

opensuse advisories openSUSE-SU-2024:11892-1openSUSE-SU-2024:11893-1

  • golang Rocky Linux 9 1.17.12-1.el9_0
  • go-toolset Rocky Linux 9 1.17.12-1.el9_0
  • delve Rocky Linux 8 1.7.2-1.module+el8.6.0+824+8e984c20
  • golang Rocky Linux 8 1.17.10-1.module+el8.6.0+986+efe4cea4
  • go-toolset Rocky Linux 8 1.17.10-1.module+el8.6.0+986+efe4cea4

rocky linux advisories RLSA-2022:5799RLSA-2022:5337

  • go Alpine 3.14 1.16.15-r0
  • go Alpine 3.15 1.17.9-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.17.8-r0

alpine advisories ALPINE-CVE-2022-24921

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.17.8-1

azure linux advisories AZL-8898

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24921 updated cvss 7.5

golang: regexp: stack exhaustion via a deeply nested expression

  • Red Hat Migration Toolkit for Containers cpma, rhmtc/openshift-migration-velero-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-grafana, servicemesh-istioctl, servicemesh-pilot-agent, +2 more
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2 golang, grafana, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src, grafana-container, prometheus-node-exporter
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 faq, runc, podman, skopeo, buildah, openshift, +22 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 mcg, noobaa-operator-container Red Hat OpenShift distributed tracing 2 rhosdt/opentelemetry-rhel8-operator Red Hat OpenShift on AWS rosa
    affected: no fix available
show 19 more
  • Red Hat OpenShift Virtualization 2 kubevirt, virt-api-container, kubemacpool-container, virt-handler-container, bridge-marker-container, virt-launcher-container, +27 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-api, container-native-virtualization/kubemacpool, container-native-virtualization/virt-handler, container-native-virtualization/bridge-marker, container-native-virtualization/virt-launcher, container-native-virtualization/virt-operator, +24 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 13 (Queens) qpid-proton, qpid-proton-c, qpid-proton-cpp, qpid-proton-tests, python-qpid-proton
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.1 etcd, qpid-proton-c, golang-qpid-apache, python3-qpid-proton Red Hat OpenStack Platform 16.2 etcd, golang-qpid-apache
    affected: no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator, quay/quay-container-security-operator-rhel8
    affected: no fix available
  • Red Hat Storage 3 etcd, golang, heketi, grafana, golang-bin, golang-src, +5 more Red Hat Service Telemetry Framework 1.2 for RHEL 8 stf/sg-core-rhel8, smart-gateway-container
    affected: no fix planned “Out of support scope”
  • Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat CNV 4.12 for RHEL 7 kubevirt 4.12.0-1057.el7, kubevirt-virtctl 4.12.0-1057.el7, kubevirt-virtctl-redistributable 4.12.0-1057.el7 Red Hat CNV 4.12 for RHEL 8 kubevirt 4.12.0-1057.el8, kubevirt-virtctl 4.12.0-1057.el8, kubevirt-virtctl-redistributable 4.12.0-1057.el8
    fixed: vendor fix RHSA-2023:0407
  • Red Hat OpenShift Service Mesh 2.1 servicemesh 2.1.5-1.el8, servicemesh-cni 2.1.5-1.el8, servicemesh-pilot-agent 2.1.5-1.el8, servicemesh-pilot-discovery 2.1.5-1.el8
    fixed: vendor fix RHSA-2022:6277
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-golang 1.17.10-1.el7_9, go-toolset-1.17-golang-bin 1.17.10-1.el7_9, go-toolset-1.17-golang-src 1.17.10-1.el7_9, go-toolset-1.17-golang-misc 1.17.10-1.el7_9, go-toolset-1.17-golang-race 1.17.10-1.el7_9, go-toolset-1.17-golang-tests 1.17.10-1.el7_9
    fixed: vendor fix RHSA-2022:5415
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.7.2-1.module+el8.6.0+12972+ebab5911, golang 1.17.10-1.module+el8.6.0+15486+6d4da7db, go-toolset 1.17.10-1.module+el8.6.0+15486+6d4da7db, golang-bin 1.17.10-1.module+el8.6.0+15486+6d4da7db, golang-src 1.17.10-1.module+el8.6.0+15486+6d4da7db, golang-misc 1.17.10-1.module+el8.6.0+15486+6d4da7db, +2 more
    fixed: vendor fix RHSA-2022:5337
  • Red Hat Enterprise Linux AppStream (v. 9) golang 1.17.12-1.el9_0, go-toolset 1.17.12-1.el9_0, golang-bin 1.17.12-1.el9_0, golang-src 1.17.12-1.el9_0, golang-misc 1.17.12-1.el9_0, golang-race 1.17.12-1.el9_0, +1 more
    fixed: vendor fix RHSA-2022:5799
  • Red Hat OpenShift Container Platform 4.10 cri-tools 1.23.0-1.1.el7, cri-tools 1.23.0-1.1.el8, cri-o 1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o 1.23.3-11.rhaos4.10.gitddf4b1a.1.el8, openshift4/ose-cli v4.10.0-202207192148.p0.g45460a5.assembly.stream, openshift4/ose-pod v4.10.0-202207192148.p0.g012e945.assembly.stream, +152 more
    fixed: vendor fix RHSA-2022:5729
  • Red Hat OpenShift Container Platform 4.11 butane 0.15.0-1.rhaos4.11.el8, ignition 2.14.0-3.rhaos4.11.el8, ignition-validate 2.14.0-3.rhaos4.11.el8, butane-redistributable 0.15.0-1.rhaos4.11.el8, openshift-clients 4.11.0-202207291716.p0.g7075089.assembly.stream.el8, openshift-clients-redistributable 4.11.0-202207291716.p0.g7075089.assembly.stream.el8
    fixed: vendor fix RHSA-2022:5068
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.3.1-4.el8
    fixed: vendor fix RHSA-2022:6042
  • Red Hat OpenShift Serverless 1.24 openshift-serverless-1/client-kn-rhel8 1.3.1-4, openshift-serverless-1/serving-queue-rhel8 1.3.0-3, openshift-serverless-1/eventing-mtping-rhel8 1.3.2-3, openshift-serverless-1/kourier-control-rhel8 1.3.0-2, openshift-serverless-1/serving-webhook-rhel8 1.3.0-3, openshift-serverless-1/eventing-webhook-rhel8 1.3.2-3, +32 more
    fixed: vendor fix RHSA-2022:6040
  • Red Hat RHACS 3.72 for RHEL 8 advanced-cluster-security/rhacs-docs-rhel8 3.72.0-3, advanced-cluster-security/rhacs-main-rhel8 3.72.0-3, advanced-cluster-security/rhacs-roxctl-rhel8 3.72.0-4, advanced-cluster-security/rhacs-scanner-rhel8 3.72.0-3, advanced-cluster-security/rhacs-rhel8-operator 3.72.0-3, advanced-cluster-security/rhacs-scanner-slim-rhel8 3.72.0-3
    fixed: vendor fix RHSA-2022:6714
  • Red Hat RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8 v4.11.0-45, odf4/mcg-core-rhel8 v4.11.0-30, odf4/ocs-rhel8-operator v4.11.0-67, odf4/ocs-must-gather-rhel8 v4.11.0-66, odf4/rook-ceph-rhel8-operator v4.11.0-49, odf4/odf-multicluster-rhel8-operator v4.11.0-29, +1 more
    fixed: vendor fix RHSA-2022:6156
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 pysnmp 4.4.8-3.el8, pyparsing 2.3.1-2.el8, libsodium 1.0.16-5.el8, python-pbr 5.5.1-2.el8, python-yappi 1.0-3.el8, python-amqp 2.5.2-8.el8, +273 more Red Hat OpenShift Service Mesh 2.1 servicemesh-proxy 2.1.5-1.el8, servicemesh-operator 2.1.5-1.el8, servicemesh-ratelimit 2.1.5-1.el8, servicemesh-proxy-wasm 2.1.5-1.el8, servicemesh-prometheus 2.23.0-9.el8 Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17 1.17.10-1.el7_9, go-toolset-1.17-build 1.17.10-1.el7_9, go-toolset-1.17-runtime 1.17.10-1.el7_9, go-toolset-1.17-scldevel 1.17.10-1.el7_9 Red Hat OpenShift Container Platform 4 conmon Red Hat OpenShift Container Platform 4.10 openstack-ironic 19.0.1-0.20220712154507.f14c488.el8, openstack-ironic-api 19.0.1-0.20220712154507.f14c488.el8, python3-ironic-tests 19.0.1-0.20220712154507.f14c488.el8, openstack-ironic-common 19.0.1-0.20220712154507.f14c488.el8, openshift 4.10.0-202207192015.p0.g012e945.assembly.stream.el7, openshift 4.10.0-202207192015.p0.g012e945.assembly.stream.el8, +35 more
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-047-04 updated cvss 7.5

Siemens Brownfield Connectivity Gateway

  • Siemens Brownfield Connectivity - Gateway <V1.10
    affected: fixed in V1.11

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

3.23% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.16.15
>=1.17.0, <1.17.8
1.16.15
1.17.8
go stdlib
<1.16.15
>=1.17.0-0, <1.17.8
1.16.15
1.17.8

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.