CVE-2022-30629

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

• CWE-330

• https://go.dev/cl/405994Patch
• https://go.dev/issue/52814Exploit, Issue Tracking, Vendor Advisory
• https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5Mailing List, Patch
• https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0531Vendor Advisory
• https://go.dev/cl/405994Patch
• https://go.dev/issue/52814Exploit, Issue Tracking, Vendor Advisory
• https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5Mailing List, Patch
• https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0531Vendor Advisory

Published

Aug 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30623The server checks the user's cookie in a non-standard way, a…9.8
• CVE-2022-30624Browsing the admin.html page allows the user to reset the ad…7.5
• CVE-2022-30625Directory listing is a web server function that displays the…5.3
• CVE-2022-30626Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show…7.5
• CVE-2022-30627This vulnerability affects all of the company's products tha…7.5
• CVE-2022-30628It was possible to download all receipts without authenticat…5.5
• CVE-2022-3063Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2022-30630Uncontrolled recursion in Glob in io/fs before Go 1.17.12 an…7.5
• CVE-2022-30631Uncontrolled recursion in Reader.Read in compress/gzip befor…7.5
• CVE-2022-30632Uncontrolled recursion in Glob in path/filepath before Go 1.…7.5
• CVE-2022-30633Uncontrolled recursion in Unmarshal in encoding/xml before G…7.5
• CVE-2022-30634Infinite loop in Read in crypto/rand before Go 1.17.11 and G…7.5