CVE-2022-2879None▾ SunlitUnbounded memory consumption when reading headers in archive/tar
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.6%
1.6% → 2.0%
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
stdlib >= 1.19.0-0, < 1.19.2Upgrade to a patched release:
stdlib 1.19.2Connected by shared product, vendor, weakness, or advisory.
CVE-2022-41715NoneMemory exhaustion when compiling regular expressions in regexp/syntax
CVE-2022-2880NoneIncorrect sanitization of forwarded query parameters in net/http/httputil
CVE-2026-97031High· 7.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references
CVE-2026-97032High· 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97030Medium· 6.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-94448Medium· 6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression