CVE-2022-30323: HashiCorp go-getter Unsafe Downloads Could Lead to Asymmetric Resource Exhaustion
Summary
CVE-2022-26945: HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion. Affects github.com/hashicorp/go-getter across 2 version ranges.
< 1.6.1
>= 2.0.0, < 2.1.0
Fixed in 1.6.1 or 2.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- golang-github-hashicorp-go-getter · Debian:11
- golang-github-hashicorp-go-getter · Debian:11
- golang-github-hashicorp-go-getter · Debian:11
- golang-github-hashicorp-go-getter · Debian:11
The same CVE-2022-26945 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp go-getter is a Go package that provides a flexible way to download files from various sources. It is commonly used in Go applications to fetch dependencies or retrieve resources. The package allows users to specify the source URL and destination path for the download. However, versions up to 2.0.2 of go-getter do not safely perform downloads, which can lead to asymmetric resource exhaustion. This vulnerability arises when go-getter processes malicious HTTP responses.
Vulnerability Detail
The vulnerability in HashiCorp go-getter allows an attacker to exploit the package's unsafe download behavior. By sending specially crafted HTTP responses, an attacker can exhaust system resources in an asymmetric manner. This can result in denial of service (DoS) conditions, where the attacker consumes more resources than the target system, leading to performance degradation or even system failure. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Latest published version: v1.8.10 as of 23 Oct 2026
go get github.com/hashicorp/go-getter@v1.8.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.11.6.1go get github.com/hashicorp/go-getter@v1.6.1 -
>= 2.0.0, < 2.1.02.1.0go get github.com/hashicorp/go-getter@v2.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of go-getter to address the issue effectively.
Conclusion
The vulnerability in HashiCorp go-getter exposes applications to the risk of asymmetric resource exhaustion. To mitigate this risk, it is crucial to update to the fixed versions of go-getter (1.6.1 for versions 0.x and 2.1.0 for versions 2.0.x). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/go-getter →
FAQ
HashiCorp go-getter is a Go package used for downloading files from various sources in Go applications.
The vulnerability in go-getter can lead to asymmetric resource exhaustion, potentially causing denial of service (DoS) conditions.
Versions up to 2.0.2 of go-getter are affected by this vulnerability.
To fix this vulnerability, update to the latest fixed version of go-getter (1.6.1 for versions 0.x and 2.1.0 for versions 2.0.x).
No, there is no known workaround for this vulnerability. Updating to the fixed versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/go-getter.
