Skip to content
Fencer Vulns
high 7.5

CVE-2022-32149 json

Denial of service via crafted Accept-Language header in golang.org/x/text/language

published 2022-10-11 4 y ago modified 2026-09-10 1 mo ago also GHSA-69ch-w2m2-3vjp , GO-2022-1059 , EUVD-2022-7037

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Patch / fix

  • go golang.org/x/text 0.3.8
  • golang.org/x/text golang.org/x/text/language 0.3.8
  • golang-golang-x-text Debian 14, Debian 13, Debian 12 0.3.8-1

debian advisories DEBIAN-CVE-2022-32149

  • golang-x-text Ubuntu 18.04 LTS 0.0~git20170627.0.6353ef0-1ubuntu2.1
  • golang-golang-x-text Ubuntu 20.04 LTS 0.3.2-4ubuntu0.1
  • golang-golang-x-text Ubuntu 22.04 LTS 0.3.7-1ubuntu0.20.04.1

ubuntu advisories UBUNTU-CVE-2022-32149

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perf openshift 4.12 4.18.0-372.59.1.el8_6
  • runc openshift 4.12 3:1.1.6-4.rhaos4.12.el8
  • conmon openshift 4.12 2:2.1.2-4.rhaos4.12.el8
  • conmon openshift 4.12 2:2.1.2-5.rhaos4.12.el9
  • kernel openshift 4.12 4.18.0-372.59.1.el8_6
  • podman openshift 4.12 3:4.2.0-6.1.rhaos4.12.el8
  • podman openshift 4.12 3:4.2.0-7.rhaos4.12.el9
  • skopeo openshift 4.12 2:1.9.4-3.1.rhaos4.12.el8

red hat advisories RHSA-2024:1994RHSA-2024:2077RHSA-2023:3613RHSA-2023:3204

  • rhnlib Manager Client Tools 15-BETA 5.0.1-159000.6.30.1
  • ansible Manager Client Tools 15-BETA 2.9.27-159000.3.9.1
  • grafana Manager Client Tools 15-BETA 9.5.8-159000.4.24.1
  • mgr-push Manager Client Tools 15-BETA 5.0.1-159000.4.21.1
  • spacecmd Manager Client Tools 15-BETA 5.0.1-159000.6.42.1
  • python-hwdata Manager Client Tools 15-BETA 2.3.5-159000.5.13.1
  • python-pyvmomi Manager Client Tools 15-BETA 6.7.3-159000.3.6.1
  • dracut-saltboot Manager Client Tools Beta for SLE Micro 5, Manager Client Tools 15-BETA 0.1.1681904360.84ef141-159000.3.30.1

suse advisories SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-EL-9-CLIENT-TOOLS-2023-3875SUSE-SU-2023:3875-1SUSE-SU-2023:3868-1SUSE-SU-2023:3867-1

  • starboard openSUSE Tumbleweed 0.15.11-1.1
  • grafana openSUSE Tumbleweed 9.3.6-1.1
  • golang-github-lusitaniae-apache_exporter openSUSE Tumbleweed 1.0.0-1.1
  • gitleaks openSUSE Tumbleweed 8.18.3-1.1

opensuse advisories openSUSE-SU-2024:12426-1openSUSE-SU-2024:12723-1openSUSE-SU-2024:13109-1openSUSE-SU-2024:14015-1

  • gitea Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.17.3-r0
  • docker-cli-compose Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.15.1-r0

alpine advisories ALPINE-CVE-2022-32149

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kured CBL-Mariner 2.0 1.13.2-1
  • application-gateway-kubernetes-ingress CBL-Mariner 2.0 1.4.0-22
  • cf-cli CBL-Mariner 2.0 8.4.0-21
  • containerized-data-importer CBL-Mariner 2.0 1.55.0-20
  • gh CBL-Mariner 2.0 2.13.0-22
  • git-lfs CBL-Mariner 2.0 3.4.1-1
  • influxdb CBL-Mariner 2.0 2.6.1-17
  • keda CBL-Mariner 2.0 2.4.0-23

azure linux advisories AZL-31972AZL-33565AZL-33572AZL-33575AZL-33583AZL-33586

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-32149 updated cvss 7.5

golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags

  • Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/work-rhel8, rhacm2/subctl-rhel9, rhacm2/thanos-rhel7, rhacm2/acmesolver-rhel8, rhacm2/cainjector-rhel8, rhacm2/agent-service-rhel8, +22 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +6 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +5 more Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, ansible-service-broker, atomic-openshift-tests, atomic-openshift-master, +19 more Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +3 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9
    affected: no fix available
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
    affected: no fix planned “Out of support scope”
  • Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
show 13 more
  • Red Hat CNV 4.13 for RHEL 7 kubevirt 4.13.0-1469.el7, kubevirt-virtctl 4.13.0-1469.el7, kubevirt-virtctl-redistributable 4.13.0-1469.el7 Red Hat CNV 4.13 for RHEL 8 kubevirt 4.13.0-1469.el8, kubevirt-virtctl 4.13.0-1469.el8, kubevirt-virtctl-redistributable 4.13.0-1469.el8 Red Hat CNV 4.13 for RHEL 9 kubevirt 4.13.0-1469.el9, kubevirt-virtctl 4.13.0-1469.el9, kubevirt-virtctl-redistributable 4.13.0-1469.el9, container-native-virtualization/virt-api-rhel9 v4.13.0--2022-101182
    fixed: vendor fix RHSA-2023:3204
  • Red Hat OpenShift API for Data Protection 1.0 oadp/oadp-velero-rhel8 1.0.7-5
    fixed: vendor fix RHSA-2023:0692
  • Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8 2.8.2-143
    fixed: vendor fix RHSA-2023:1042
  • Red Hat OpenShift Developer Tools and Services for OCP 4.9 for RHEL 8 ocp-tools-4/service-binding-rhel8-operator v1.3.1-5, ocp-tools-4/service-binding-operator-bundle v1.3.1-7
    fixed: vendor fix RHSA-2022:7407
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-302
    fixed: vendor fix RHSA-2022:6882
  • Red Hat Quay v3 quay/clair-rhel8 v3.8.11-3, quay/quay-rhel8 v3.8.11-13, quay/quay-builder-rhel8 v3.8.11-4, quay/quay-operator-rhel8 v3.8.11-3, quay/quay-operator-bundle v3.8.11-20, quay/quay-bridge-operator-rhel8 v3.8.11-3, +4 more
    fixed: vendor fix RHBA-2023:4275
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) crun 1.5-1.module+el8.6.0+21266+3e24c7b3, crit 3.15-3.module+el8.6.0+21266+3e24c7b3, criu 3.15-3.module+el8.6.0+21266+3e24c7b3, runc 1.1.12-1.module+el8.6.0+21266+3e24c7b3, udica 0.2.6-5.module+el8.6.0+21266+3e24c7b3, conmon 2.1.4-1.module+el8.6.0+21266+3e24c7b3, +27 more
    fixed: vendor fix RHSA-2024:1994
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) crit 3.15-4.module+el8.8.0+21741+dd5be1e7, criu 3.15-4.module+el8.8.0+21741+dd5be1e7, crun 1.8.4-2.module+el8.8.0+21741+dd5be1e7, runc 1.1.12-1.module+el8.8.0+21741+dd5be1e7, conmon 2.1.6-1.module+el8.8.0+21741+dd5be1e7, udica 0.2.6-20.module+el8.8.0+21741+dd5be1e7, +27 more
    fixed: vendor fix RHSA-2024:2077
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-velero-rhel8 v1.7.7-5
    fixed: vendor fix RHSA-2023:0693
  • Red Hat OpenShift Container Platform 4.12 podman 4.2.0-7.rhaos4.12.el9, podman 4.2.0-6.1.rhaos4.12.el8, podman-tests 4.2.0-7.rhaos4.12.el9, podman-docker 4.2.0-7.rhaos4.12.el9, podman-remote 4.2.0-7.rhaos4.12.el9, podman-gvproxy 4.2.0-7.rhaos4.12.el9, +8 more
    fixed: vendor fix RHSA-2023:3613
  • Red Hat RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-300
    fixed: vendor fix RHSA-2022:7435
  • Red Hat RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-303
    fixed: vendor fix RHSA-2022:7434
  • Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/virtio-win-rhel9 v4.13.0--2022-101182, container-native-virtualization/kubemacpool-rhel9 v4.13.0--2022-101182, container-native-virtualization/virt-handler-rhel9 v4.13.0--2022-101182, container-native-virtualization/bridge-marker-rhel9 v4.13.0--2022-101182, container-native-virtualization/multus-dynamic-networks-rhel9 v4.13.0-37, container-native-virtualization/virt-launcher-rhel9 v4.13.0--2022-101182, +39 more Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-must-gather-api-rhel8 Red Hat OpenShift API for Data Protection 1.0 oadp/oadp-registry-rhel8 1.0.7-3, oadp/oadp-rhel8-operator 1.0.7-2, oadp/oadp-operator-bundle 1.0.7-8, oadp/oadp-mustgather-rhel8 1.0.7-4, oadp/oadp-velero-plugin-rhel8 1.0.7-2, oadp/oadp-velero-plugin-for-aws-rhel8 1.0.7-2, +5 more Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8 2.8.2-143, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator 2.8.2-143, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-operator-bundle 2.8.2-143 Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-217, openshift-logging/kibana6-rhel8 v6.8.1-298, openshift-logging/elasticsearch6-rhel8 v6.8.1-261, openshift-logging/logging-curator5-rhel8 v5.8.1-242, openshift-logging/elasticsearch-rhel8-operator v5.3.13-5, openshift-logging/cluster-logging-rhel8-operator v5.3.13-9, +3 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    +5 more products
    Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.7-3, rhmtc/openshift-velero-plugin-rhel8 v1.7.7-3, rhmtc/openshift-migration-openvpn-rhel8 v1.7.7-2, rhmtc/openshift-migration-registry-rhel8 v1.7.7-3, rhmtc/openshift-migration-rhel8-operator v1.7.7-9, rhmtc/openshift-migration-operator-bundle v1.7.7-9, +10 more Red Hat OpenShift Container Platform 4 cri-o, cri-tools, openshift-golang-builder-container Red Hat OpenShift Container Platform 4.12 perf 4.18.0-372.59.1.el8_6, runc 1.1.6-4.rhaos4.12.el8, conmon 2.1.2-4.rhaos4.12.el8, conmon 2.1.2-5.rhaos4.12.el9, kernel 4.18.0-372.59.1.el8_6, skopeo 1.9.4-3.rhaos4.12.el9, +60 more Red Hat RHOL 5.4 for RHEL 8 openshift-logging/vector-rhel8 v0.14-67, openshift-logging/fluentd-rhel8 v1.14.5-36, openshift-logging/kibana6-rhel8 v6.8.1-302, openshift-logging/eventrouter-rhel8 v0.4.0-55, openshift-logging/logging-loki-rhel8 v2.5.0-51, openshift-logging/loki-rhel8-operator v5.4.8-4, +10 more Red Hat RHOL 5.5 for RHEL 8 openshift-logging/vector-rhel8 v0.21.0-34, openshift-logging/fluentd-rhel8 v1.14.6-61, openshift-logging/kibana6-rhel8 v6.8.1-301, openshift-logging/eventrouter-rhel8 v0.4.0-52, openshift-logging/logging-loki-rhel8 v2.6.1-21, openshift-logging/loki-rhel8-operator v5.5.4-4, +11 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/text
<0.3.8
0.3.8

Affected products

  • golang.org/x/text golang.org/x/text/language

Classification

Weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.