CVE catalog
CVE-2022-41715
golang-1.19: CVE-2022-41715
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.73% · Oct 25, 2026
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-1.19 | bookworm | 1.19.8-2 | fixed |
| Suse | golang-github-prometheus-prometheus | manager client tools 15 | 2.37.6-150000.3.47.2 | fixed |
| Suse | prometheus-blackbox_exporter | manager client tools 15 | 0.19.0-150000.1.17.2 | fixed |
| Suse | prometheus-postgres_exporter | manager client tools 15 | 0.10.1-150000.1.11.4 | fixed |
| Suse | prometheus-blackbox_exporter | manager client tools for sle micro 5 | 0.19.0-150000.1.17.2 | fixed |
| Suse | prometheus-blackbox_exporter | manager proxy module 4.2 | 0.19.0-150000.1.17.2 | fixed |
| Suse | prometheus-blackbox_exporter | manager proxy module 4.3 | 0.19.0-150000.1.17.2 | fixed |
| Suse | prometheus-postgres_exporter | manager server module 4.2 | 0.10.1-150000.1.11.4 | fixed |
| Opensuse | golang-github-prometheus-promu | leap 15.4 | 0.14.0-150000.3.12.2 | fixed |
| Opensuse | prometheus-blackbox_exporter | leap 15.4 | 0.19.0-150000.1.17.2 | fixed |
| Opensuse | prometheus-postgres_exporter | leap 15.4 | 0.10.1-150000.1.11.4 | fixed |
| Ubuntu | golang-1.10 | 14.04 | 1.10.4-2ubuntu1~14.04.1 | vulnerable |
| Ubuntu | golang-1.10 | 16.04 | 1.10.4-2ubuntu1~16.04.1 | vulnerable |
| Ubuntu | golang-1.10 | 16.04 | 1.10.4-2ubuntu1~16.04.2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu3 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu4 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu5 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.1-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.3 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.4 | vulnerable |
| Ubuntu | golang-1.13 | pro | 1.13.8-1ubuntu2 | vulnerable |
| Ubuntu | golang-1.13 | pro | 1.13.8-1ubuntu2.22.04.1 | vulnerable |
| Ubuntu | golang-1.13 | pro | 1.13.8-1ubuntu2.22.04.1+esm1 | vulnerable |
| Ubuntu | golang-1.13 | pro | 1.13.8-1ubuntu2.22.04.2 | vulnerable |
| Ubuntu | golang-1.18 | 18.04 | 1.18.1-1ubuntu1~18.04.3 | vulnerable |
| Ubuntu | golang-1.18 | 18.04 | 1.18.1-1ubuntu1~18.04.4 | fixed |
| Ubuntu | golang-1.10 | 18.04 | 1.10~rc1-1 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10~rc1-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10~rc1-2ubuntu1 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10~rc2-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10.1-1ubuntu2 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10.4-2ubuntu1~18.04.1 | vulnerable |
| Ubuntu | golang-1.10 | 18.04 | 1.10.4-2ubuntu1~18.04.2 | vulnerable |
| Ubuntu | golang-1.16 | pro | 1.16.2-0ubuntu1~20.04 | vulnerable |
| Ubuntu | golang-1.16 | pro | 1.16.2-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | golang-1.16 | pro | 1.16.2-0ubuntu1~20.04.1+esm1 | vulnerable |
| Ubuntu | golang-1.8 | 18.04 | 1.8.3-2ubuntu1 | vulnerable |
| Ubuntu | golang-1.8 | 18.04 | 1.8.3-2ubuntu1.18.04.1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.1-2ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.2-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.2-3ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.3-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.9 | 18.04 | 1.9.4-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.18 | 20.04 | 1.18.1-1ubuntu1~20.04.1 | vulnerable |
| Ubuntu | golang-1.18 | 20.04 | 1.18.1-1ubuntu1~20.04.2 | fixed |
| Ubuntu | golang-1.13 | 20.04 | 1.13.1-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.3-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.4-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.5-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.6-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.6-2ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.7-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.8-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.8-1ubuntu1.1 | vulnerable |
| Ubuntu | golang-1.13 | 20.04 | 1.13.8-1ubuntu1.2 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14~beta1-1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14~beta1-2 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14~rc1-1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14-1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14.1-1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14.2-1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14.2-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14.3-2ubuntu2~20.04.1 | vulnerable |
| Ubuntu | golang-1.14 | 20.04 | 1.14.3-2ubuntu2~20.04.2 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18~beta1-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18~beta2-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18~beta2-1ubuntu2 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18~rc1-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18.1-1ubuntu1 | vulnerable |
| Ubuntu | golang-1.18 | 22.04 | 1.18.1-1ubuntu1.1 | fixed |
| Suse | golang-github-prometheus-prometheus | linux enterprise module for package hub 15 sp5 | 2.45.6-150100.4.20.1 | fixed |
| Suse | golang-github-prometheus-prometheus | linux enterprise module for package hub 15 sp6 | 2.45.6-150100.4.20.1 | fixed |
| Suse | golang-github-prometheus-prometheus | manager proxy module 4.3 | 2.45.6-150100.4.20.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | leap 15.5 | 2.45.6-150100.4.20.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | leap 15.6 | 2.45.6-150100.4.20.1 | fixed |
| Suse | golang-github-prometheus-prometheus | linux enterprise module for package hub 15 sp5 | 2.37.6-150100.4.17.1 | fixed |
| Suse | golang-github-prometheus-prometheus | manager proxy module 4.2 | 2.37.6-150100.4.17.1 | fixed |
| Suse | golang-github-prometheus-prometheus | manager proxy module 4.3 | 2.37.6-150100.4.17.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | leap 15.4 | 2.37.6-150100.4.17.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | leap 15.5 | 2.37.6-150100.4.17.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | tumbleweed | 2.48.1-2.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-1.19 | source | bookworm | 1.19.2-1 | not yet assigned | Not reported | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager client tools 15 | 2.37.6-150000.3.47.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Suse | prometheus-blackbox_exporter | rpm | manager client tools 15 | 0.19.0-150000.1.17.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Suse | prometheus-postgres_exporter | rpm | manager client tools 15 | 0.10.1-150000.1.11.4 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Suse | prometheus-blackbox_exporter | rpm | manager client tools for sle micro 5 | 0.19.0-150000.1.17.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Suse | prometheus-blackbox_exporter | rpm | manager proxy module 4.2 | 0.19.0-150000.1.17.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Suse | prometheus-blackbox_exporter | rpm | manager proxy module 4.3 | 0.19.0-150000.1.17.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Suse | prometheus-postgres_exporter | rpm | manager server module 4.2 | 0.10.1-150000.1.11.4 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Opensuse | golang-github-prometheus-promu | rpm | leap 15.4 | 0.14.0-150000.3.12.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Opensuse | prometheus-blackbox_exporter | rpm | leap 15.4 | 0.19.0-150000.1.17.2 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Opensuse | prometheus-postgres_exporter | rpm | leap 15.4 | 0.10.1-150000.1.11.4 | Not reported | SUSE-SU-2023:2182-1 | Not reported |
| Ubuntu | golang-1.18 | deb | 18.04 | 1.18.1-1ubuntu1~18.04.4 | Not reported | UBUNTU-CVE-2022-41715 | Not reported |
| Ubuntu | golang-1.18 | deb | 20.04 | 1.18.1-1ubuntu1~20.04.2 | Not reported | UBUNTU-CVE-2022-41715 | Not reported |
| Ubuntu | golang-1.18 | deb | 22.04 | 1.18.1-1ubuntu1.1 | Not reported | UBUNTU-CVE-2022-41715 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | linux enterprise module for package hub 15 sp5 | 2.45.6-150100.4.20.1 | Not reported | SUSE-SU-2024:3288-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | linux enterprise module for package hub 15 sp6 | 2.45.6-150100.4.20.1 | Not reported | SUSE-SU-2024:3288-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager proxy module 4.3 | 2.45.6-150100.4.20.1 | Not reported | SUSE-SU-2024:3288-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | leap 15.5 | 2.45.6-150100.4.20.1 | Not reported | SUSE-SU-2024:3288-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | leap 15.6 | 2.45.6-150100.4.20.1 | Not reported | SUSE-SU-2024:3288-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | linux enterprise module for package hub 15 sp5 | 2.37.6-150100.4.17.1 | Not reported | SUSE-SU-2023:2598-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager proxy module 4.2 | 2.37.6-150100.4.17.1 | Not reported | SUSE-SU-2023:2598-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | manager proxy module 4.3 | 2.37.6-150100.4.17.1 | Not reported | SUSE-SU-2023:2598-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | leap 15.4 | 2.37.6-150100.4.17.1 | Not reported | SUSE-SU-2023:2598-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | leap 15.5 | 2.37.6-150100.4.17.1 | Not reported | SUSE-SU-2023:2598-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | tumbleweed | 2.48.1-2.1 | Not reported | OPENSUSE-SU-2024:13604-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [golang-1.19]Fixed
Details (2)
1.19.8-2· all · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
1.19.8-2· all · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
- [golang-1.19-doc]Fixed
Source package: [golang-1.19]
Details (2)
1.19.8-2· all · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
1.19.8-2· all · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
- [golang-1.19-go]Fixed
Source package: [golang-1.19]
Details (2)
1.19.8-2· amd64 · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
1.19.8-2· arm64 · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
- [golang-1.19-src]Fixed
Source package: [golang-1.19]
Details (2)
1.19.8-2· all · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
1.19.8-2· all · bookwormFixed · Fixed:
1.19.2-1dsa · golang-1.19 · debian · bookworm
[openSUSE Tumbleweed]
Source package: [golang-github-prometheus-prometheus]
Details (1)
3.13.2-1.1· x86_64 · tumbleweedFixed · Fixed:
2.48.1-2.1dsa · golang-github-prometheus-prometheus · opensuse · tumbleweed
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-806742.json]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_0446.json]
- [https://osv.dev/vulnerability/SUSE-SU-2023:2182-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:2598-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:3288-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-41715]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13604-1]
- [https://security-tracker.debian.org/tracker/CVE-2022-41715]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41715.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1350.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]