CVE-2022-28131: Stack exhaustion from deeply nested XML documents in encoding/xml
Summary
CVE-2022-28131: Stack exhaustion from deeply nested XML documents in encoding/xml. Affects stdlib across 2 version ranges.
< 1.17.12
>= 1.18.0-0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-28131 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The encoding/xml package in the Go standard library provides functionality for encoding and decoding XML data. It is commonly used in Go applications to handle XML documents. The package includes various functions and types for parsing and manipulating XML data. However, a vulnerability has been discovered in the package that can lead to stack exhaustion when parsing deeply nested XML documents.
Vulnerability Detail
The vulnerability (CVE-2022-28131) arises when the Decoder.Skip function is called while parsing a deeply nested XML document. This can trigger a panic due to stack exhaustion, potentially causing the application to crash. An attacker could exploit this vulnerability by crafting a malicious XML document with excessive nesting, leading to a denial-of-service (DoS) condition. The impact of this vulnerability is limited to applications that use the encoding/xml package and parse XML data.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12go get stdlib@v1.17.12 -
>= 1.18.0-0, < 1.18.41.18.4go get stdlib@v1.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing input validation and limiting the depth of nested XML documents that their applications can handle. This can help prevent excessive resource consumption and potential stack exhaustion.
Conclusion
The encoding/xml package in the Go standard library is vulnerable to a stack exhaustion issue when parsing deeply nested XML documents. This can lead to a denial-of-service (DoS) condition. To mitigate the risk, it is recommended to update the Go standard library to the latest version and implement input validation to limit the depth of nested XML documents. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability affects versions 0.0.0 to 1.17.11 and 1.18.0-0 to 1.18.3 of the Go standard library.
The vulnerability can lead to a denial-of-service (DoS) condition, causing the affected application to crash.
No, this vulnerability requires an attacker to provide a specially crafted XML document for parsing.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
No, a CVSS score has not been assigned to this vulnerability at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
