{"id":"CVE-2022-30634","aliases":["ALPINE-CVE-2022-30634","AZL-78962","AZL-98796","BELL-CVE-2022-30634","BIT-golang-2022-30634","EUVD-2022-52465","GHSA-vfh9-chgv-wfph","GO-2022-0477","OESA-2022-1783","SUSE-SU-2022:2004-1","SUSE-SU-2022:2005-1","SUSE-SU-2023:2312-1","UBUNTU-CVE-2022-30634","openSUSE-SU-2024:12123-1","openSUSE-SU-2024:12124-1"],"status":"published","title":"Indefinite hang with large buffers on Windows in crypto/rand","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02278,"percentile":0.83247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2022-06-07T14:34:31Z","modified":"2026-11-03T07:31:15Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.18.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.17.11","1.18.3"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.17.11","1.18.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.18.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.11"},{"introduced":"1.18.0"},{"fixed":"1.18.3"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.11"},{"introduced":"1.18.0-0"},{"fixed":"1.18.3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-14.oe1"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-14.oe1"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-5.oe2203"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-150000.1.37.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-150000.1.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"go1.18-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10.1-150000.1.9.1"}]}],"bundled":28},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.11-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.1"}]}],"bundled":4}],"products":[{"vendor":"go standard library","product":"crypto/rand"},{"vendor":"golang","product":"go"},{"vendor":"netapp","product":"cloud_insights_telegraf_agent"}],"references":[{"url":"https://go.dev/cl/402257","tags":["x_transferred","Patch","fix","web"]},{"url":"https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863","tags":["x_transferred","Mailing List","Patch","fix","web"]},{"url":"https://go.dev/issue/52561","tags":["x_transferred","Exploit","Issue Tracking","evidence","web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0477","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30634","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0004/"},{"url":"https://github.com/advisories/GHSA-vfh9-chgv-wfph"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-30634","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-30634","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30634.json","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1705","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222004-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190649","tags":["report"]},{"url":"https://bugzilla.suse.com/1200134","tags":["report"]},{"url":"https://bugzilla.suse.com/1200135","tags":["report"]},{"url":"https://bugzilla.suse.com/1200136","tags":["report"]},{"url":"https://bugzilla.suse.com/1200137","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30634","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193742","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232312-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183043","tags":["report"]},{"url":"https://bugzilla.suse.com/1198423","tags":["report"]},{"url":"https://bugzilla.suse.com/1198424","tags":["report"]},{"url":"https://bugzilla.suse.com/1198427","tags":["report"]},{"url":"https://bugzilla.suse.com/1199413","tags":["report"]},{"url":"https://bugzilla.suse.com/1201434","tags":["report"]},{"url":"https://bugzilla.suse.com/1201436","tags":["report"]},{"url":"https://bugzilla.suse.com/1201437","tags":["report"]},{"url":"https://bugzilla.suse.com/1201440","tags":["report"]},{"url":"https://bugzilla.suse.com/1201443","tags":["report"]},{"url":"https://bugzilla.suse.com/1201444","tags":["report"]},{"url":"https://bugzilla.suse.com/1201445","tags":["report"]},{"url":"https://bugzilla.suse.com/1201447","tags":["report"]},{"url":"https://bugzilla.suse.com/1201448","tags":["report"]},{"url":"https://bugzilla.suse.com/1202035","tags":["report"]},{"url":"https://bugzilla.suse.com/1203185","tags":["report"]},{"url":"https://bugzilla.suse.com/1204023","tags":["report"]},{"url":"https://bugzilla.suse.com/1204024","tags":["report"]},{"url":"https://bugzilla.suse.com/1204025","tags":["report"]},{"url":"https://bugzilla.suse.com/1204941","tags":["report"]},{"url":"https://bugzilla.suse.com/1206134","tags":["report"]},{"url":"https://bugzilla.suse.com/1206135","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208271","tags":["report"]},{"url":"https://bugzilla.suse.com/1208272","tags":["report"]},{"url":"https://bugzilla.suse.com/1208491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41725","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-30634","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg","tags":["report"]},{"url":"https://github.com/golang/go/commit/32dedaa69e22f1a058ae90b9484fd4c3b46fbcbf","tags":["report"]},{"url":"https://github.com/golang/go/commit/2be03d789de905a4b050ff5f3a51b724e1b09494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30634","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-30634","title":"Indefinite hang with large buffers on Windows in crypto/rand","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T19:36:19Z","modified":"2024-08-03T06:56:13.255Z","updated_at":"2026-11-02T14:34:31.184134Z"}],"euvd":[{"id":"EUVD-2022-52465","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T19:36:19Z","modified":"2024-08-03T06:56:13Z","updated_at":"2026-11-03T03:25:35.869088Z"}],"ghsa":[{"id":"GHSA-vfh9-chgv-wfph","title":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker...","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-16T00:00:20Z","modified":"2023-01-27T05:07:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:43:08.293944Z"}],"nvd":[{"id":"CVE-2022-30634","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T20:15:08.597Z","modified":"2026-06-17T04:43:59.317Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"ALPINE-CVE-2022-30634","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T20:15:08.597Z","modified":"2026-11-03T07:31:15.676511106Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"AZL-78962","title":"CVE-2022-30634 affecting package golang 1.25.7-1","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T20:15:08Z","modified":"2026-04-21T04:34:33.203007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98796","title":"CVE-2022-30634 affecting package golang 1.27.1-1","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T20:15:08Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2022-30634","title":"CVE-2022-30634 does not affect BellSoft software","status":"withdrawn","published":"2022-07-15T20:15:00Z","modified":"2026-01-26T09:48:17.075876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"OESA-2022-1783","title":"golang security update","description":"The Go Programming Language\r\n\r\nSecurity Fix(es):\r\n\r\nWhen httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.(CVE-2022-32148)\n\nCalling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.(CVE-2022-30635)\n\nInfinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u0026lt;\u0026lt; 32 - 1 bytes. (CVE-2022-30634)\n\nCalling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.(CVE-2022-30633)\n\nCalling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.(CVE-2022-30632)\n\nCalling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.(CVE-2022-30631)\n\nAs required by RFC 8446, section 4.6.1, ticket_age_add now holds arandom 32-bit value. Before this change, this value was always setto 0.(CVE-2022-30629)\n\nCalling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.(CVE-2022-28131)\n\nCalling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.(CVE-2022-1962)\n\nThe HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a chunked encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.(CVE-2022-1705)","status":"published","published":"2022-07-29T11:05:03Z","modified":"2026-08-18T01:16:51.263559868Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-30634","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T20:15:00Z","modified":"2025-10-24T04:53:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"BIT-golang-2022-30634","title":"Indefinite hang with large buffers on Windows in crypto/rand","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2024-03-06T10:59:32.189Z","modified":"2026-09-08T08:47:48.430098556Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"CVE-2022-30634","title":"Indefinite hang with large buffers on Windows in crypto/rand","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-07-15T19:36:19Z","modified":"2026-10-28T02:31:08.34098104Z","updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GO-2022-0477","title":"Indefinite hang with large buffers on Windows in crypto/rand","description":"On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 \u003c\u003c 32 - 1 bytes.","status":"published","published":"2022-06-09T01:43:37Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2024:12123-1","title":"go1.17-1.17.11-1.1 on GA media","description":"These are all security issues fixed in the go1.17-1.17.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:29.10711Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12124-1","title":"go1.18-1.18.3-1.1 on GA media","description":"These are all security issues fixed in the go1.18-1.18.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:24.450412Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2004-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\nUpdate to go1.17.11 (released 2022-06-01) (bsc#1190649):\n\n- CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134).\n- CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135).\n- CVE-2022-29804: Fixed path/filepath Clean(`.\\c:`) returns `c:` on Windows (bsc#1200137).\n- CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136).\n","status":"published","published":"2022-06-07T14:34:31Z","modified":"2026-02-04T02:42:05.221104Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2005-1","title":"Security update for go1.18","description":"This update for go1.18 fixes the following issues:\n\nUpdate to go1.18.3 (released 2022-06-01) (bsc#1193742):\n\n- CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134).\n- CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135).\n- CVE-2022-29804: Fixed path/filepath Clean(`.\\c:`) returns `c:` on Windows (bsc#1200137).\n- CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136).\n","status":"published","published":"2022-06-07T14:34:56Z","modified":"2026-02-04T02:29:04.305054Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2023:2312-1","title":"Security update for go1.18-openssl","description":"This update for go1.18-openssl fixes the following issues:\n\n- Add subpackage go1.x-libstd compiled shared object libstd.so (jsc#PED-1962)\n  * Main go1.x package included libstd.so in previous versions\n  * Split libstd.so into subpackage that can be installed standalone\n  * Continues the slimming down of main go1.x package by 40 Mb\n  * Experimental and not recommended for general use, Go currently has no ABI\n  * Upstream Go has not committed to support buildmode=shared long-term\n  * Do not use in packaging, build static single binaries (the default)\n  * Upstream Go go1.x binary releases do not include libstd.so\n  * go1.x Suggests go1.x-libstd so not installed by default Recommends\n  * go1.x-libstd does not Require: go1.x so can install standalone\n  * Provides go-libstd unversioned package name\n  * Fix build step -buildmode=shared std to omit -linkshared\n- Packaging improvements:\n  * go1.x Suggests go1.x-doc so not installed by default Recommends\n  * Use Group: Development/Languages/Go instead of Other\n\n- Improvements to go1.x packaging spec:\n  * On Tumbleweed bootstrap with current default gcc13 and gccgo118\n  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap\n    using go1.x package (%bcond_without gccgo). This is no longer\n    needed on current SLE-12:Update and removing will consolidate\n    the build configurations used.\n  * Change source URLs to go.dev as per Go upstream\n  * On x86_64 export GOAMD64=v1 as per the current baseline.\n    At this time forgo GOAMD64=v3 option for x86_64_v3 support.\n  * On x86_64 %define go_amd64=v1 as current instruction baseline\n\n- Update to version 1.18.10.1 cut from the go1.18-openssl-fips\n  branch at the revision tagged go1.18.10-1-openssl-fips.\n  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips\n  * Merge go1.18.10 into dev.boringcrypto.go1.18\n\n- go1.18.10 (released 2023-01-10) includes fixes to cgo, the\n  compiler, the linker, and the crypto/x509, net/http, and syscall\n  packages.\n  Refs bsc#1193742 go1.18 release tracking\n  * go#57705 misc/cgo: backport needed for dlltool fix\n  * go#57426 crypto/x509: Verify on macOS does not return typed errors\n  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its 'old' argument.\n  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices\n  * go#57213 os: TestLstat failure on Linux Aarch64\n  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length\n  * go#57057 cmd/go: remove test dependency on gopkg.in service\n  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders\n  * go#57044 cgo: malformed DWARF TagVariable entry\n  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14\n  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused\n  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target\n  * go#56323 net/http: bad handling of HEAD requests with a body\n","status":"published","published":"2023-05-30T06:54:51Z","modified":"2026-02-04T03:20:56.665396Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}