CVE-2022-41715: Memory exhaustion when compiling regular expressions in regexp/syntax
Vulnerability summary
CVE-2022-41715 is a high (CVSS 7.5) vulnerability in go standard library regexp/syntax. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.5% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 36 · Related 17Timeline
- 14-10-2022PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.73%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
Increase +0.29 pp
From 1.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard10 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compat< 0.19.0-r40
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
Wolfi10 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compat< 0.19.0-r40
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
Ubuntu8 products
- golang-1.10All versions (No fix recorded)
- golang-1.13All versions (No fix recorded)
- golang-1.14All versions (No fix recorded)
- golang-1.16All versions (No fix recorded)
- golang-1.18< 1.18.1-1ubuntu1~18.04.4 | < 1.18.1-1ubuntu1~20.04.2 | < 1.18.1-1ubuntu1.1
Redhat3 products
- golang-github-cpuguy83-md2man< 0:2.0.2-4.el9
- golang-github-cpuguy83-md2man-debuginfo< 0:2.0.2-4.el9
- golang-github-cpuguy83-md2man-debugsource< 0:2.0.2-4.el9
Alpine1 product
- go≥ 1.19.0, < 1.18.7-r0 | ≥ 1.19.0, < 1.19.2-r0
Debian1 product
- golang-1.19< 1.19.2-1
Go1 product
- stdlib≥ 1.19.0-0, < 1.19.2
Go standard library1 product
- regexp/syntax< 1.18.7 | ≥ 1.19.0-0, < 1.19.2
Golang1 product
- go< 1.18.7 | ≥ 1.19.0, < 1.19.2
Opensuse1 product
- golang-github-prometheus-prometheus&distro=openSUSE Tumbleweed< 2.48.1-2.1
10 vendors · 37 products
References
24 links- pkg.go.dev/vuln/GO-2022-1039Vendor Advisory
