CVE-2022-2879

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

• CWE-770

• https://go.dev/cl/439355Patch
• https://go.dev/issue/54853Issue Tracking, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/xtuG5faxtaUMailing List, Release Notes
• https://pkg.go.dev/vuln/GO-2022-1037Vendor Advisory
• https://security.gentoo.org/glsa/202311-09
• https://go.dev/cl/439355Patch
• https://go.dev/issue/54853Issue Tracking, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/xtuG5faxtaUMailing List, Release Notes
• https://pkg.go.dev/vuln/GO-2022-1037Vendor Advisory
• https://security.gentoo.org/glsa/202311-09

Published

Oct 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28784Path traversal vulnerability in Galaxy Themes prior to SMR M…3.3
• CVE-2022-28785Improper buffer size check logic in aviextractor library pri…5.5
• CVE-2022-28786Improper buffer size check logic in aviextractor library pri…5.5
• CVE-2022-28787Improper buffer size check logic in wmfextractor library pri…5.5
• CVE-2022-28788Improper buffer size check logic in aviextractor library pri…5.5
• CVE-2022-28789Unprotected activities in Voice Note prior to version 21.3.5…5.5
• CVE-2022-28790Improper authentication in Link to Windows Service prior to …3.3
• CVE-2022-28791Improper input validation vulnerability in InstallAgent in G…5.5
• CVE-2022-28792DLL hijacking vulnerability in Gear IconX PC Manager prior t…7.8
• CVE-2022-28793Given the TEE is compromised and controlled by the attacker,…4.4
• CVE-2022-28794Sensitive information exposure in low-battery dumpstate log …3.3
• CVE-2022-28795A vulnerability within the Avira Password Manager Browser Ex…6.5