CVE-2022-1962
Assigner: Go
Published: 2022-08-09T20:18:18
State: PUBLISHED
title: Stack exhaustion due to deeply nested types in go/parser
descriptions: value: Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
affected: vendor: Go standard library
product: go/parser
collectionURL: https://pkg.go.dev
packageName: go/parser
versions: version: 0
lessThan: 1.17.12
status: affected
versionType: semver
version: 1.18.0-0
lessThan: 1.18.4
status: affected
versionType: semver
programRoutines: ParseFile
ParseExprFrom
parser.tryIdentOrType
parser.parsePrimaryExpr
parser.parseUnaryExpr
parser.parseBinaryExpr
parser.parseIfStmt
parser.parseStmt
resolver.openScope
resolver.closeScope
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-674: Uncontrolled Recursion
credits: value: Juho Nurminen of Mattermost