Skip to content
Fencer Vulns
high 7.5

CVE-2022-32189 json

Panic when decoding Float and Rat types in math/big

published 2022-08-01 4 y ago modified 2026-10-08 31 d ago also BIT-golang-2022-32189 , EUVD-2022-53401 , GO-2022-0537

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

Patch / fix

  • bitnami golang 1.17.13, 1.18.5
  • go stdlib 1.17.13, 1.18.5
  • Go standard library math/big 1.17.13, 1.18.5
  • golang-1.19 Debian 12 1.19-1

debian advisories DEBIAN-CVE-2022-32189

  • golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.2
  • golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.2
  • golang-1.16 Ubuntu 20.04 LTS 1.16.2-0ubuntu1~20.04.1
  • golang-1.18 Ubuntu 18.04 LTS 1.18.1-1ubuntu1~18.04.4
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.2
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.1
  • golang-1.13 Ubuntu Pro 16.04 LTS 1.13.8-1ubuntu1~16.04.3+esm3
  • golang-1.13 Ubuntu Pro 18.04 LTS 1.13.8-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2022-32189

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.8.0+17821+de1b53f1
  • criu RHEL 8 3.15-3.module+el8.8.0+17821+de1b53f1
  • crun RHEL 8 1.6-1.module+el8.8.0+17821+de1b53f1
  • runc RHEL 8 1:1.1.4-1.module+el8.8.0+17821+de1b53f1
  • udica RHEL 8 0.2.6-3.module+el8.8.0+17821+de1b53f1
  • conmon RHEL 8 2:2.1.4-1.module+el8.8.0+17821+de1b53f1
  • podman RHEL 8 2:4.0.2-20.module+el8.8.0+18201+6ad7332c
  • skopeo RHEL 8 2:1.6.2-6.module+el8.8.0+17821+de1b53f1

red hat advisories RHSA-2023:2802RHSA-2023:2758RHSA-2023:0446RHSA-2023:3204RHSA-2023:2357RHSA-2023:2236

  • go1.18-openssl SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +6 more 1.18.10.1-150000.1.9.1
  • go1.18 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.18.5-150000.1.25.1
  • go1.17 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +10 more 1.17.13-150000.1.42.1

suse advisories SUSE-SU-2023:2312-1SUSE-SU-2022:2672-1SUSE-SU-2022:2671-1

  • go1.17 openSUSE Tumbleweed 1.17.13-1.1
  • go1.18 openSUSE Tumbleweed 1.18.5-1.1

opensuse advisories openSUSE-SU-2024:12229-1openSUSE-SU-2024:12230-1

  • crit AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • criu AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • crun AlmaLinux 8 1.8.1-2.module_el8.8.0+3568+e8578284
  • runc AlmaLinux 8 1:1.1.4-1.module_el8.7.0+3407+95aa0ca9
  • udica AlmaLinux 8 0.2.6-20.module_el8.8.0+3470+252b1910
  • conmon AlmaLinux 8 3:2.1.6-1.module_el8.8.0+3470+252b1910
  • podman AlmaLinux 8 3:4.4.1-8.module_el8.8.0+3568+e8578284
  • skopeo AlmaLinux 8 2:1.11.2-0.2.module_el8.8.0+3470+252b1910

almalinux advisories ALSA-2023:2758ALSA-2023:2802ALSA-2023:2193ALSA-2023:2236ALSA-2023:2357ALSA-2022:7950

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • cockpit-podman Rocky Linux 8 46-1.module+el8.9.0+1445+07728297
  • oci-seccomp-bpf-hook Rocky Linux 8 1.2.5-2.module+el8.9.0+1445+07728297
  • osbuild Rocky Linux 9 65-1.el9.rocky.0.1
  • weldr-client Rocky Linux 9 35.5-4.el9
  • cockpit-composer Rocky Linux 9 41-1.el9
  • osbuild Rocky Linux 8 65-1.el8.rocky.0.1

rocky linux advisories RLSA-2023:2758RLSA-2023:2802RLSA-2022:7950RLSA-2022:7548RLSA-2022:7129

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.18.5-r0

alpine advisories ALPINE-CVE-2022-32189

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.18.5-1

azure linux advisories AZL-10539

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-32189 updated cvss 6.5

golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service

  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator
    affected: workaround, no fix available
  • Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Developer Tools and Services odo, helm, ocp-tools-4/jenkins-rhel8
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/work-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator Red Hat Ansible Automation Platform 2 receptor, openshift-clients
    affected: workaround, no fix available
  • Red Hat Application Interconnect 1.0 skupper-cli, openshift4/egress-router-cni-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: workaround, no fix planned “Out of support scope”
show 19 more
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 8 runc, podman, skopeo, buildah, grafana, toolbox, +30 more Red Hat Enterprise Linux 9 runc, podman, skopeo, buildah, grafana, ignition, +18 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 runc, conmon, podman, skopeo, buildah, openshift, +18 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 mcg
    affected: workaround, no fix available
  • Red Hat OpenShift Dev Spaces devspaces/devspaces-rhel8-operator
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa
    affected: workaround, no fix available
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 golang-qpid-apache, collectd-libpod-stats, rhosp-rhel8/osp-director-operator
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Quay 3 quay/clair-rhel8
    affected: workaround, no fix available
  • Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Web Terminal web-terminal-exec-container
    affected: workaround, no fix available
  • Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat CNV 4.13 for RHEL 7 kubevirt 4.13.0-1469.el7, kubevirt-virtctl 4.13.0-1469.el7, kubevirt-virtctl-redistributable 4.13.0-1469.el7 Red Hat CNV 4.13 for RHEL 8 kubevirt 4.13.0-1469.el8, kubevirt-virtctl 4.13.0-1469.el8, kubevirt-virtctl-redistributable 4.13.0-1469.el8 Red Hat CNV 4.13 for RHEL 9 kubevirt 4.13.0-1469.el9, kubevirt-virtctl 4.13.0-1469.el9, kubevirt-virtctl-redistributable 4.13.0-1469.el9, container-native-virtualization/virt-api-rhel9 v4.13.0--2022-101182
    fixed: vendor fix RHSA-2023:3204
  • Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8 7.12.0-7, amq7/amq-broker-init-rhel8 7.12.0-7, amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10
    fixed: vendor fix RHSA-2024:2944
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-26
    fixed: vendor fix RHSA-2023:0584
  • Red Hat AI Inference Server 3.2 rhaiis 1772713830
    fixed: vendor fix RHSA-2026:4128
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix RHSA-2023:3642
  • Red Hat Enterprise Linux AppStream (v. 8) git-lfs 2.13.3-3.el8_6, weldr-client 35.5-4.el8, crun 1.6-1.module+el8.8.0+17821+de1b53f1, crit 3.15-3.module+el8.8.0+17821+de1b53f1, crit 3.15-3.module+el8.8.0+18060+3f21f2cc, criu 3.15-3.module+el8.8.0+17821+de1b53f1, +70 more
    fixed: vendor fix RHSA-2022:7129
  • Red Hat Enterprise Linux AppStream (v. 9) butane 0.16.0-1.el9, git-lfs 3.2.0-1.el9, golang 1.18.9-1.el9_1, toolbox 0.0.99.3-9.el9, weldr-client 35.5-4.el9, golang-bin 1.18.9-1.el9_1, +5 more
    fixed: vendor fix RHSA-2022:7950

9 more fixed, 19 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

2.78% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • go.dev https://go.dev/issue/53871 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.17.13
>=1.18.0, <1.18.5
1.17.13
1.18.5
go stdlib
<1.17.13
>=1.18.0-0, <1.18.5
1.17.13
1.18.5

Affected products

  • Go standard library math/big

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.