CVE-2022-30631

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

• CWE-674

• https://go.dev/cl/417067Patch, Vendor Advisory
• https://go.dev/issue/53168Issue Tracking, Vendor Advisory
• https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185eMailing List, Patch, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/nqrv9fbR0zEMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0524Vendor Advisory
• https://go.dev/cl/417067Patch, Vendor Advisory
• https://go.dev/issue/53168Issue Tracking, Vendor Advisory
• https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185eMailing List, Patch, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/nqrv9fbR0zEMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0524Vendor Advisory

Published

Aug 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30626Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show…7.5
• CVE-2022-30627This vulnerability affects all of the company's products tha…7.5
• CVE-2022-30628It was possible to download all receipts without authenticat…5.5
• CVE-2022-30629Non-random values for ticket_age_add in session tickets in c…3.1
• CVE-2022-3063Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2022-30630Uncontrolled recursion in Glob in io/fs before Go 1.17.12 an…7.5
• CVE-2022-30632Uncontrolled recursion in Glob in path/filepath before Go 1.…7.5
• CVE-2022-30633Uncontrolled recursion in Unmarshal in encoding/xml before G…7.5
• CVE-2022-30634Infinite loop in Read in crypto/rand before Go 1.17.11 and G…7.5
• CVE-2022-30635Uncontrolled recursion in Decoder.Decode in encoding/gob bef…7.5
• CVE-2022-30636httpTokenCacheKey uses path.Base to extract the expected HTT…7.5
• CVE-2022-30637Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (…7.8