CVE-2022-26945: Resource exhaustion in github.com/hashicorp/go-getter and related modules
Summary
CVE-2022-26945: Resource exhaustion in github.com/hashicorp/go-getter and related modules. Affects github.com/hashicorp/go-getter versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- golang-github-hashicorp-go-getter · Debian:11
- golang-github-hashicorp-go-getter · Debian:11
- golang-github-hashicorp-go-getter · Debian:11
- golang-github-hashicorp-go-getter · Debian:11
The same CVE-2022-26945 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package github.com/hashicorp/go-getter is a Go library that provides a simple way to fetch or download files, directories, and repositories from various sources. It is commonly used in Go projects for retrieving dependencies or fetching remote resources. However, this package and its related modules are vulnerable to a resource exhaustion issue that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability in github.com/hashicorp/go-getter and related modules allows for several misbehaviors, including overwriting local files, resource exhaustion, and panics. This can be triggered by malicious HTTP responses. The following are the key aspects of the vulnerability:
- Protocol switching, endless redirect, and configuration bypass can be achieved through abuse of custom HTTP response header processing.
- Arbitrary host access is possible through go-getter path traversal, symlink processing, and command injection flaws.
- Asymmetric resource exhaustion can occur when go-getter processes malicious HTTP responses.
- A panic can be triggered when go-getter processes password-protected ZIP files.
How To Fix
Latest published version: v1.8.10 as of 23 Oct 2026
go get github.com/hashicorp/go-getter@v1.8.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/hashicorp/go-getter@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The resource exhaustion vulnerability in github.com/hashicorp/go-getter and related modules can have serious security implications. It is crucial to update the affected packages to the fixed versions mentioned in the 'how_to_fix' section to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/go-getter →
FAQ
This vulnerability can lead to various security issues, including file overwriting, resource exhaustion, and panics. It can be exploited by malicious actors to gain unauthorized access or disrupt the functionality of the affected application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
The only known mitigation is to update the affected packages to the fixed versions mentioned in the 'how_to_fix' section. It is important to keep your dependencies up to date to ensure the security of your application.
At the time of this report, there is no known public exploit available for this vulnerability. However, it is always recommended to patch vulnerabilities as soon as possible to prevent any potential exploitation.
You can find more information about this vulnerability, including technical details and the affected packages, in the vulnerability report on the VulnDB website: https://vuln.go.dev/ID/GO-2022-0586.json
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/go-getter.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
