CVE-2022-41715None▾ SunlitMemory exhaustion when compiling regular expressions in regexp/syntax
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
1.3% → 1.4%
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.
The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory.
After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.
stdlib >= 1.19.0-0, < 1.19.2Upgrade to a patched release:
stdlib 1.19.2Connected by shared product, vendor, weakness, or advisory.
CVE-2022-2880NoneIncorrect sanitization of forwarded query parameters in net/http/httputil
CVE-2022-2879NoneUnbounded memory consumption when reading headers in archive/tar
CVE-2026-56860High· 7.5Avoid quadratic complexity in resolvePath in net/url
CVE-2026-56858High· 8.1Fix Javascript regexp context tracking in html/template
CVE-2026-56862High· 7.5Limit handshake messages we are willing to accept post-handshake in crypto/tls
CVE-2026-56859High· 7.5Add recursion depth guard during decode in encoding/xml