CVE-2022-24675 in Google
Summary
by MITRE • 04/20/2022
encoding/pem in Go before 1.17.9 and 1.8.x before 1.8.1 has a Decode stack overflow via a large amount of PEM data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/03/2026
The vulnerability identified as CVE-2022-24675 affects the Go programming language's encoding/pem package, specifically impacting versions prior to 1.17.9 and 1.8.x versions before 1.8.1. This issue manifests as a stack overflow condition that occurs during the decoding process of PEM data, representing a critical security flaw that can lead to application crashes and potential denial of service conditions. The vulnerability stems from insufficient input validation and recursive processing mechanisms within the PEM decoding algorithm that fails to properly handle excessively large data inputs.
The technical flaw resides in the recursive parsing approach used by the PEM decoder when processing malformed or excessively large PEM data structures. When the decoder encounters a large amount of PEM data, particularly in scenarios involving deeply nested or malformed structures, it recursively processes the input without adequate stack depth limitations. This recursive behavior causes the call stack to grow uncontrollably until it exceeds the system's stack limit, resulting in a stack overflow exception that terminates the application process. The vulnerability is classified under CWE-674, which deals with uncontrolled recursion in software systems, and aligns with ATT&CK technique T1499.004 related to network denial of service attacks through resource exhaustion.
The operational impact of this vulnerability extends beyond simple application crashes, as it can be exploited in various attack scenarios including remote code execution in vulnerable applications that process untrusted PEM data from external sources. Systems utilizing Go applications that handle certificate processing, cryptographic operations, or any functionality that relies on PEM data parsing become susceptible to this attack vector. The vulnerability is particularly concerning in environments where applications process user-provided or third-party PEM data without proper validation, as attackers can craft malicious PEM structures designed to trigger the stack overflow condition during normal processing operations.
Mitigation strategies for CVE-2022-24675 primarily involve upgrading to affected Go versions that contain the patched implementation, specifically Go 1.17.9 or later, and Go 1.8.1 or later releases. Organizations should conduct thorough vulnerability assessments to identify all systems running vulnerable Go versions and prioritize patching efforts accordingly. Additional defensive measures include implementing input validation controls that limit the size and complexity of PEM data processed by applications, introducing rate limiting mechanisms for PEM processing operations, and deploying monitoring solutions that can detect unusual stack usage patterns. Security teams should also consider implementing application sandboxing and memory protection mechanisms to limit the impact of potential exploitation attempts, while maintaining comprehensive logging of PEM processing activities to facilitate forensic analysis if incidents occur.