CVE-2022-30634: Indefinite hang with large buffers on Windows in crypto/rand
Summary
CVE-2022-30634: Indefinite hang with large buffers on Windows in crypto/rand. Affects stdlib across 2 version ranges.
< 1.17.11
>= 1.18.0-0, < 1.18.3
Fixed in 1.17.11 or 1.18.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-30634 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. The crypto/rand package within stdlib is responsible for generating random numbers and cryptographic keys. It is used to ensure the security and randomness of various cryptographic operations in Go applications.
Vulnerability Detail
The vulnerability (CVE-2022-30634) affects the crypto/rand package on Windows systems. When the rand.Read function is called with a buffer larger than 1 << 32 - 1 bytes, it will hang indefinitely. This can lead to a denial-of-service (DoS) condition, as the application will be stuck waiting for the random number generation to complete. The issue arises due to a limitation in the Windows implementation of rand.Read.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.17.111.17.11go get stdlib@v1.17.11 -
>= 1.18.0-0, < 1.18.31.18.3go get stdlib@v1.18.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can ensure that the buffer size passed to rand.Read on Windows systems is smaller than 1 << 32 - 1 bytes. By keeping the buffer size within this limit, the hang issue can be avoided. Here is an example of how to limit the buffer size:
c := make([]byte, 1<<31)
if runtime.GOOS == "windows" && len(c) > (1<<32-1) {
c = c[:1<<32-1]
}
rand.Read(c)
Conclusion
The vulnerability (CVE-2022-30634) in the crypto/rand package on Windows systems can lead to an indefinite hang in applications, causing a denial-of-service (DoS) condition. To fix this issue, developers should update their Go version to 1.17.11 or 1.18.3, or any subsequent fixed versions. A workaround is also available by limiting the buffer size passed to rand.Read on Windows systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can cause an indefinite hang in applications that use the crypto/rand package on Windows systems. This can lead to a denial-of-service (DoS) condition, as the application becomes unresponsive while waiting for random number generation to complete.
Versions 0.0.0 to 1.17.10 and 1.18.0-0 to 1.18.2 of the stdlib package in Go are affected by this vulnerability.
No, this vulnerability only affects Windows systems.
Yes, developers can update their Go version to 1.17.11 or 1.18.3, or any subsequent fixed versions, to address this vulnerability.
Yes, a workaround is available. Developers can limit the buffer size passed to rand.Read on Windows systems to avoid triggering the hang issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
