CVE-2021-33198 In Go before 1.15.13 and 1.16.x before 1.16.5 there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting Go's math/big Package Identified Two vulnerabilities in Go's math/big package have been reported. CVE-2021-33198, published on August 2, 2021, can cause a panic for large exponents in the SetString or UnmarshalText methods. CVE-2022-23772, published on February 11, 2022, involves an overflow that may lead to uncontrolled memory consumption in the Rat.SetString method. 2 sources 46

Extracted Entities

CVEs (1)