CVE-2023-24537: Infinite loop in parsing in go/scanner
Summary
CVE-2023-24537: Infinite loop in parsing in go/scanner. Affects stdlib across 2 version ranges.
< 1.19.8
>= 1.20.0-0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-24537 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide functionality for various tasks. The gohttps://vulert.com/scanner package is part of the stdlib and is responsible for parsing Go source code. It includes functions like Scanner.Scan and Scanner.updateLineInfo. This vulnerability affects versions 0 through 1.19.8 and versions 1.20.0-0 through 1.20.3 of the stdlib package.
Vulnerability Detail
The vulnerability arises when any of the Parse functions are called on Go source code that contains //line directives with very large line numbers. This triggers an infinite loop due to integer overflow. The impact of this vulnerability is that it can cause the affected application to enter an infinite loop, leading to denial of service and potential resource exhaustion.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8go get stdlib@v1.19.8 -
>= 1.20.0-0, < 1.20.31.20.3go get stdlib@v1.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the stdlib package is not immediately feasible, a possible workaround is to avoid using //line directives with very large line numbers in the Go source code. By keeping the line numbers within a reasonable range, the vulnerability can be mitigated. Here is an example of how to avoid using large line numbers:
// Instead of:
//line myfile.go:1000000000
// Use:
//line myfile.go:1000
Conclusion
In summary, the stdlib package in Go is vulnerable to an infinite loop in parsing when encountering //line directives with very large line numbers. This can lead to denial of service and potential resource exhaustion. It is recommended to update the stdlib package to version 1.19.8 or apply the fix included in versions 1.20.0-0 through 1.20.3 to mitigate this vulnerability. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can cause the affected application to enter an infinite loop, leading to denial of service and potential resource exhaustion.
Versions 0 through 1.19.8 and versions 1.20.0-0 through 1.20.3 of the stdlib package are affected.
To fix this vulnerability, update the stdlib package to version 1.19.8 or apply the fix included in versions 1.20.0-0 through 1.20.3.
Yes, you can avoid using //line directives with very large line numbers in the Go source code to mitigate the vulnerability.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2023-1702.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
