Go DER Parsing Vulnerability

MEDIUM (5.3) No Patch (51 days)

Threat Intelligence

Low Risk
EPSS Score: 0.03% chance of exploitation (percentile: 9%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: No public exploits found

How we test →

What is it?

The Go programming language has a vulnerability in its DER payload parsing. This allows attackers to allocate large amounts of memory, causing memory exhaustion.

Am I affected?

You're affected if you use Go version 1.18 or later (due to the fix being introduced in Go 1.19). Check with: go version command

Affected Packages

go: github.com/golang/go

Affected Products

The Go Team / Go

How to fix

Upgrade to Go 1.19 or later from the official Go website: https://golang.org/doc/upgrading
- Immediate mitigations:
- Disable DER parsing by setting derparse disabled=true in your go.mod file.
- Monitor for memory exhaustion errors.