CVE-2022-24921: Stack exhaustion when compiling deeply nested expressions in regexp
Summary
CVE-2022-24921: Stack exhaustion when compiling deeply nested expressions in regexp. Affects stdlib across 2 version ranges.
< 1.16.15
>= 1.17.0-0, < 1.17.8
Fixed in 1.16.15 or 1.17.8, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-24921 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. One of the packages in the stdlib is 'regexp', which provides regular expression matching. Regular expressions are widely used for pattern matching and text manipulation in various applications.
Vulnerability Detail
This vulnerability, identified as CVE-2022-24921, affects the 'regexp.Compile' function in the 'regexp' package. On 64-bit platforms, when compiling an extremely deeply nested expression, the function can cause stack exhaustion in goroutines. This can lead to the program exiting unexpectedly. It's important to note that this vulnerability only applies to very large expressions, typically on the order of 2MB.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.16.151.16.15go get stdlib@v1.16.15 -
>= 1.17.0-0, < 1.17.81.17.8go get stdlib@v1.17.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the 'regexp.Compile' function in the Go stdlib's 'regexp' package is vulnerable to stack exhaustion when compiling deeply nested expressions. This can lead to unexpected program termination. It is recommended to update to a fixed version of the Go stdlib to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can cause goroutine stack exhaustion, leading to the program exiting unexpectedly. This can result in denial of service or unexpected termination of the affected application.
Versions 0.0.0 to 1.16.14 and versions 1.17.0-0 to 1.17.7 of the Go stdlib are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this report.
Yes, the fix for this vulnerability is available in versions 1.16.15 and 1.17.8 of the Go stdlib.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
