ThreatCluster

Multiple CVEs Affecting Go's math/big Package Identified

First seen 18 Feb 2026, 13:23 UTC •Api.Msrc.Microsoft •46

Article Content

Browse articles
ThreatCluster

Two vulnerabilities in Go's math/big package have been reported. CVE-2021-33198, published on August 2, 2021, can cause a panic for large exponents in the SetString or UnmarshalText methods. CVE-2022-23772, published on February 11, 2022, involves an overflow that may lead to uncontrolled memory consumption in the Rat.SetString method.

How this analysis works

Timeline

2021-08-02
CVE-2021-33198 published
2022-02-11
CVE-2022-23772 published
2026-02-18
Articles published regarding both CVEs

Extracted Entities

1 / 2