CVE-2022-23772 Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting Go's math/big Package Identified Two vulnerabilities in Go's math/big package have been reported. CVE-2021-33198, published on August 2, 2021, can cause a panic for large exponents in the SetString or UnmarshalText methods. CVE-2022-23772, published on February 11, 2022, involves an overflow that may lead to uncontrolled memory consumption in the Rat.SetString method. 2 sources 46

Extracted Entities

CVEs (1)