7.5

CVE-2022-32189: Panic when decoding Float and Rat types in math/big

Modified
AliasesMGASA-2022-0283RHSA-2022:7548RHSA-2022:7950
Published 09-08-2022Last modified 08-10-2026

Vulnerability summary

CVE-2022-32189 is a high (CVSS 7.5) vulnerability in go standard library math/big. EPSS estimates a 2.78% chance of exploitation in the next 30 days, higher than 86.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
2.78%
0%100%
Low · +0.15 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 17 · Related 5
RHSA-2022:7129RHSA-2022:7398RHSA-2022:8626RHSA-2023:0328RHSA-2023:0446RHSA-2023:1275

Timeline

  1. 09-08-2022
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

2.78%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +0.15 pp

From 2.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (go.dev)

    Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu9 products
  • golang-1.10All versions (No fix recorded)
  • golang-1.13< 1.13.8-1ubuntu1~16.04.3+esm3 | < 1.13.8-1ubuntu1~18.04.4+esm1 | < 1.13.8-1ubuntu1.2 | < 1.13.8-1ubuntu2.22.04.2
  • golang-1.14All versions (No fix recorded)
  • golang-1.16< 1.16.2-0ubuntu1~18.04.2+esm1 | < 1.16.2-0ubuntu1~20.04.1
  • golang-1.17All versions (No fix recorded)
Redhat8 products
  • butane< 0:0.15.0-3.rhaos4.11.el8
  • butane-debuginfo< 0:0.15.0-3.rhaos4.11.el8
  • butane-debugsource< 0:0.15.0-3.rhaos4.11.el8
  • butane-redistributable< 0:0.15.0-3.rhaos4.11.el8
  • weldr-client< 0:35.5-4.el8 | < 0:35.5-4.el9
Opensuse2 products
  • go1.17&distro=openSUSE Tumbleweed< 1.17.13-1.1
  • go1.18&distro=openSUSE Tumbleweed< 1.18.5-1.1
Alpine1 product
  • go≥ 1.18.0, < 1.18.5-r0
Debian1 product
  • golang-1.19< 1.19-1
Go1 product
  • stdlib≥ 1.18.0-0, < 1.18.5
Go standard library1 product
  • math/big< 1.17.13 | ≥ 1.18.0-0, < 1.18.5
Golang1 product
  • go< 1.17.13 | ≥ 1.18.0, < 1.18.5
Mageia1 product
  • golang< 1.17.13-1.mga8

9 vendors · 25 products

References

51 links
Show all 51 references