CVE-2022-32149: Denial of service via crafted Accept-Language header in golang.org/x/text/language

Modified

AliasesRHSA-2024:1994UBUNTU-CVE-2022-32149DEBIAN-CVE-2022-32149+86 more

Published 14-10-2022Last modified 15-05-2025

Vulnerability summary

CVE-2022-32149 is a high (CVSS 7.5) vulnerability in golang text. EPSS estimates a 1.84% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.84%

0%100%

Low · +0.37 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

14-10-2022
PublishedVulnerability first disclosed.
15-05-2025
Last modifiedVulnerability information updated.

Description

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

CVSS metrics

9 scores · 9 sources · 1 version

v3.17.5

EPSS trend

Probability

1.84%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

Increase +0.37 pp

From 1.47% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat67 products

aardvark-dns< 2:1.0.1-40.module+el8.6.0+21266+3e24c7b3
buildah< 1:1.26.2-1.module+el8.6.0+21266+3e24c7b3
buildah-debuginfo< 1:1.26.2-1.module+el8.6.0+21266+3e24c7b3
buildah-debugsource< 1:1.26.2-1.module+el8.6.0+21266+3e24c7b3
buildah-tests< 1:1.26.2-1.module+el8.6.0+21266+3e24c7b3

buildah-tests-debuginfo< 1:1.26.2-1.module+el8.6.0+21266+3e24c7b3
cockpit-podman< 0:49.1-1.module+el8.6.0+21266+3e24c7b3
conmon< 2:2.1.4-1.module+el8.6.0+21266+3e24c7b3
conmon-debuginfo< 2:2.1.4-1.module+el8.6.0+21266+3e24c7b3
conmon-debugsource< 2:2.1.4-1.module+el8.6.0+21266+3e24c7b3
container-selinux< 2:2.189.0-1.module+el8.6.0+21266+3e24c7b3
containernetworking-plugins< 1:1.1.1-4.module+el8.6.0+21266+3e24c7b3
containernetworking-plugins-debuginfo< 1:1.1.1-4.module+el8.6.0+21266+3e24c7b3
containernetworking-plugins-debugsource< 1:1.1.1-4.module+el8.6.0+21266+3e24c7b3
containers-common< 2:1-40.module+el8.6.0+21266+3e24c7b3
crit< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
criu< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
criu-debuginfo< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
criu-debugsource< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
criu-devel< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
criu-libs< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
criu-libs-debuginfo< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
crun< 0:1.5-1.module+el8.6.0+21266+3e24c7b3
crun-debuginfo< 0:1.5-1.module+el8.6.0+21266+3e24c7b3
crun-debugsource< 0:1.5-1.module+el8.6.0+21266+3e24c7b3
fuse-overlayfs< 0:1.9-1.module+el8.6.0+21266+3e24c7b3
fuse-overlayfs-debuginfo< 0:1.9-1.module+el8.6.0+21266+3e24c7b3
fuse-overlayfs-debugsource< 0:1.9-1.module+el8.6.0+21266+3e24c7b3
libslirp< 0:4.4.0-1.module+el8.6.0+21266+3e24c7b3
libslirp-debuginfo< 0:4.4.0-1.module+el8.6.0+21266+3e24c7b3
libslirp-debugsource< 0:4.4.0-1.module+el8.6.0+21266+3e24c7b3
libslirp-devel< 0:4.4.0-1.module+el8.6.0+21266+3e24c7b3
netavark< 2:1.0.1-40.module+el8.6.0+21266+3e24c7b3
oci-seccomp-bpf-hook< 0:1.2.6-1.module+el8.6.0+21266+3e24c7b3
oci-seccomp-bpf-hook-debuginfo< 0:1.2.6-1.module+el8.6.0+21266+3e24c7b3
oci-seccomp-bpf-hook-debugsource< 0:1.2.6-1.module+el8.6.0+21266+3e24c7b3
podman< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-catatonit< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-catatonit-debuginfo< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-debuginfo< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-debugsource< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-docker< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-gvproxy< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-gvproxy-debuginfo< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-plugins< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-plugins-debuginfo< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-remote< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-remote-debuginfo< 2:4.2.0-2.module+el8.6.0+21674+8010760f
podman-tests< 2:4.2.0-2.module+el8.6.0+21674+8010760f
python-podman< 0:4.0.1-1.module+el8.6.0+21266+3e24c7b3
python3-criu< 0:3.15-3.module+el8.6.0+21266+3e24c7b3
python3-podman< 0:4.0.1-1.module+el8.6.0+21266+3e24c7b3
runc< 1:1.1.12-1.module+el8.6.0+21266+3e24c7b3
runc-debuginfo< 1:1.1.12-1.module+el8.6.0+21266+3e24c7b3
runc-debugsource< 1:1.1.12-1.module+el8.6.0+21266+3e24c7b3
skopeo< 2:1.9.1-1.module+el8.6.0+21266+3e24c7b3
skopeo-debuginfo< 2:1.9.1-1.module+el8.6.0+21266+3e24c7b3
skopeo-debugsource< 2:1.9.1-1.module+el8.6.0+21266+3e24c7b3
skopeo-tests< 2:1.9.1-1.module+el8.6.0+21266+3e24c7b3
slirp4netns< 0:1.2.0-3.module+el8.6.0+21266+3e24c7b3
slirp4netns-debuginfo< 0:1.2.0-3.module+el8.6.0+21266+3e24c7b3
slirp4netns-debugsource< 0:1.2.0-3.module+el8.6.0+21266+3e24c7b3
toolbox< 0:0.0.99.3-0.7.module+el8.6.0+21266+3e24c7b3
toolbox-debuginfo< 0:0.0.99.3-0.7.module+el8.6.0+21266+3e24c7b3
toolbox-debugsource< 0:0.0.99.3-0.7.module+el8.6.0+21266+3e24c7b3
toolbox-tests< 0:0.0.99.3-0.7.module+el8.6.0+21266+3e24c7b3
udica< 0:0.2.6-5.module+el8.6.0+21266+3e24c7b3

Show all 67

Chainguard41 products

dex-k8s-authenticatorAll versions (No fix recorded)
dynamic-localpv-provisioner< 3.4.1-r3
dynamic-localpv-provisioner-fips< 3.5.0-r0
gitleaks< 8.18.2-r1
grpcurl< 1.8.7-r7

Show all 41

Wolfi23 products

dynamic-localpv-provisioner< 3.4.1-r3
gitleaks< 8.18.2-r1
grpcurl< 1.8.7-r7
hey< 0.1.4-r3
k3d< 5.6.0-r11

Show all 23

Alpine2 products

docker-cli-compose< 2.15.1-r0
gitea< 1.17.3-r0

Ubuntu2 products

golang-golang-x-text< 0.3.2-4ubuntu0.1 | < 0.3.7-1ubuntu0.20.04.1
golang-x-textAll versions (No fix recorded) | < 0.0~git20170627.0.6353ef0-1ubuntu2.1

Debian1 product

golang-golang-x-text< 0.3.8-1

Golang1 product

text< 0.3.8

Golang.org/x1 product

text< 0.3.8

Golang.org/x/text1 product

golang.org/x/text/language< 0.3.8

Opensuse1 product

starboard&distro=openSUSE Tumbleweed< 0.15.11-1.1

10 vendors · 140 products

References

24 links

go.dev/issue/56152ARTICLEREPORTWEBIssue TrackingThird Party Advisory
go.dev/cl/442235WEBFIXVendor Advisory
groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJWEBMailing ListThird Party Advisory
pkg.go.dev/vuln/GO-2022-1059WEBVendor Advisory
security.netapp.com/advisory/ntap-20230203-0006/Advisory
access.redhat.com/errata/RHSA-2024:1994Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2134010REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1994.jsonAdvisory
access.redhat.com/security/cve/CVE-2022-32149REPORT

Show all 24 references

www.cve.org/CVERecord?id=CVE-2022-32149AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2022-32149AdvisoryOval
groups.google.com/g/golang-dev/c/qfPIly0X7aUARTICLEREPORT
ubuntu.com/security/CVE-2022-32149REPORT
github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72cREPORTWEB
ubuntu.com/security/notices/USN-5873-1Advisory
security-tracker.debian.org/tracker/CVE-2022-32149Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32149.jsonAdvisory
github.com/golang/go/issues/56152WEB
github.com/golang/textPACKAGE
security.netapp.com/advisory/ntap-20230203-0006WEB
www.suse.com/security/cve/CVE-2022-32149WEB
security.alpinelinux.org/vuln/CVE-2022-32149Advisory