CVE-2022-30631: Stack exhaustion when reading certain archives in compress/gzip
Summary
CVE-2022-30631: Stack exhaustion when reading certain archives in compress/gzip. Affects stdlib across 2 version ranges.
< 1.17.12
>= 1.18.0-0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-30631 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. The compress/gzip package within stdlib allows for the reading and writing of gzip-compressed files. This vulnerability, identified as CVE-2022-30631, arises when the Reader.Read function is called on an archive containing a large number of concatenated 0-length compressed files. This can lead to a panic due to stack exhaustion.
Vulnerability Detail
The vulnerability in compress/gzip arises from a stack exhaustion issue. When the Reader.Read function is invoked on an archive that contains numerous concatenated 0-length compressed files, it can cause a panic due to stack exhaustion. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition in applications that utilize the compress/gzip package. It is important to note that this vulnerability affects versions 0 through 1.17.12 and 1.18.0-0 through 1.18.4 of the stdlib package in Go.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12go get stdlib@v1.17.12 -
>= 1.18.0-0, < 1.18.41.18.4go get stdlib@v1.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the stdlib package to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the compress/gzip package in the stdlib package of Go is vulnerable to a stack exhaustion issue when reading certain archives. This can result in a denial-of-service (DoS) condition in affected applications. To mitigate this vulnerability, it is crucial to update the stdlib package to version 1.17.12 or 1.18.4. Regularly updating all dependencies is also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition in applications that utilize the compress/gzip package. An attacker can exploit this vulnerability to cause a panic due to stack exhaustion, resulting in the unavailability of the affected application.
Versions 0 through 1.17.12 and 1.18.0-0 through 1.18.4 of the stdlib package in Go are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is essential to update the stdlib package to the fixed versions.
To update the stdlib package, users should update their Go installation to the latest available version, which includes the necessary fixes. It is also recommended to regularly update all dependencies to ensure the use of patched versions.
No, this vulnerability does not allow for remote code execution. It primarily leads to a denial-of-service (DoS) condition.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
