CVE-2020-28362: Flawed Division Method in math/big Package
Summary
CVE-2020-28362: Panic during division of very large numbers in math/big. Affects stdlib across 2 version ranges.
>= 1.14.0-0, < 1.14.12
>= 1.15.0-0, < 1.15.5
Fixed in 1.14.12 or 1.15.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2020-28362 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The math/big package in the Go standard library provides arbitrary-precision arithmetic operations on integers. It includes the big.Int type, which represents signed multi-precision integers. This vulnerability affects versions 1.14.0-1.14.12 and 1.15.0-1.15.5 of the Go standard library.
Vulnerability Detail
The flaw in the division method of math/big.Int can lead to panics when large inputs are provided. This vulnerability arises due to a flawed division algorithm implemented in the nat.divRecursiveStep function of the math/big package. Attackers can exploit this vulnerability to cause denial-of-service (DoS) conditions or potentially execute arbitrary code.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.14.0-0, < 1.14.121.14.12go get stdlib@v1.14.12 -
>= 1.15.0-0, < 1.15.51.15.5go get stdlib@v1.15.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can implement their own division method for large numbers, taking into account the limitations of the flawed division algorithm in the math/big package. Here is an example of a workaround implementation:
import (
"math/big"
)
func safeDivide(x, y *big.Int) *big.Int {
if y.Sign() == 0 {
// Handle division by zero
return nil
}
// Implement safe division logic here
}
Conclusion
The flawed division method in the math/big package can lead to panics and potential DoS conditions in applications. It is crucial to update the affected packages to the latest versions and ensure the use of the updated Go standard library. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can lead to panics and potential denial-of-service (DoS) conditions in applications that use the math/big package for division operations with large numbers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground and it will alert you in real-time if your application is vulnerable.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to update the affected packages to prevent potential exploitation.
While updating the Go standard library is the recommended solution, you can implement a workaround by using a custom division method that takes into account the limitations of the flawed division algorithm in the math/big package.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2021-0069.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
