CVE-2022-32189

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.17.13 Go versions prior to 1.18.5

Description Decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service. A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go.

Recommendations For Go versions prior to 1.17.13, update to version 1.17.13 or later to resolve the issue. For Go versions prior to 1.18.5, update to version 1.18.5 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Float.GobDecode and Rat.GobDecode functions until a patch is available.