CVE catalog

CVE-2022-1962

golang-1.19: CVE-2022-1962

Severity: Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Jul 12, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.92% · Oct 25, 2026

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-1.19	bookworm	`1.19.8-2`	fixed
Ubuntu	golang-1.18	18.04	`1.18.1-1ubuntu1~18.04.3`	vulnerable
Ubuntu	golang-1.18	18.04	`1.18.1-1ubuntu1~18.04.4`	fixed
Ubuntu	golang-1.18	20.04	`1.18.1-1ubuntu1~20.04.1`	vulnerable
Ubuntu	golang-1.18	20.04	`1.18.1-1ubuntu1~20.04.2`	fixed
Ubuntu	golang-1.18	22.04	`1.18~beta1-0ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~beta2-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~beta2-1ubuntu2`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~rc1-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18.1-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18.1-1ubuntu1.1`	fixed
Opensuse	velero	tumbleweed	`1.9.2-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-1.19	source	bookworm	`1.19~rc2-1`	not yet assigned	Not reported	Not reported
Ubuntu	golang-1.18	deb	18.04	`1.18.1-1ubuntu1~18.04.4`	Not reported	UBUNTU-CVE-2022-1962	Not reported
Ubuntu	golang-1.18	deb	20.04	`1.18.1-1ubuntu1~20.04.2`	Not reported	UBUNTU-CVE-2022-1962	Not reported
Ubuntu	golang-1.18	deb	22.04	`1.18.1-1ubuntu1.1`	Not reported	UBUNTU-CVE-2022-1962	Not reported
Opensuse	velero	rpm	tumbleweed	`1.9.2-1.1`	Not reported	OPENSUSE-SU-2024:12492-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[velero-bash-completion]Unknown
Source package: [velero]
Details (1)
- 1.18.2-1.3 · noarch · tumbleweed
  Unknown · Fixed: 1.9.2-1.1
  Version impact unknown
  dsa · velero · opensuse · tumbleweed
[velero-fish-completion]Unknown
Source package: [velero]
Details (1)
- 1.18.2-1.3 · noarch · tumbleweed
  Unknown · Fixed: 1.9.2-1.1
  Version impact unknown
  dsa · velero · opensuse · tumbleweed
[velero-zsh-completion]Unknown
Source package: [velero]
Details (1)
- 1.18.2-1.3 · noarch · tumbleweed
  Unknown · Fixed: 1.9.2-1.1
  Version impact unknown
  dsa · velero · opensuse · tumbleweed
[velero]Fixed
Source package: [velero]
Details (1)
- 1.18.2-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 1.9.2-1.1
  dsa · velero · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[golang-1.19]Fixed
Details (2)
- 1.19.8-2 · all · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · all · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
[golang-1.19-doc]Fixed
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · all · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · all · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
[golang-1.19-go]Fixed
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · amd64 · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · arm64 · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
[golang-1.19-src]Fixed
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · all · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm
- 1.19.8-2 · all · bookworm
  Fixed · Fixed: 1.19~rc2-1
  dsa · golang-1.19 · debian · bookworm

Observed: Oct 23, 2026, 6:23:27 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]