CVE-2020-28362: Panic during division of very large… – CVSS 7.5 · Watchpost

← All vulnerabilities

Panic during division of very large numbers in math/big

HIGH 7.5CVE-2020-28362 · BIT-golang-2020-28362 · GO-2021-0069 · Published 18/11/2020 · updated 17/06/2026

In short

CVE-2020-28362 is a HIGH (CVSS 7.5) vulnerability affecting stdlib, go (golang).
Chance of exploitation in the next 30 days (EPSS): 3.9%, higher than 90.2% of all vulnerabilities.
Fix: update to 1.14.12, 1.15.5 or later.

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.14.0-0, < 1.14.12≥ 1.15.0-0, < 1.15.5`	`1.14.121.15.5`
go golang	`≥ 1.15, < 1.15.5< 1.14.12`	`1.15.51.14.12`

Description

A number of math/big.Int methods can panic when provided large inputs due to a flawed division method.

NVD description

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

References

go.dev/cl/269657 · FIX
go.googlesource.com/go/+/1e1fa5903b760c6714ba17e50bf850b01f49135c · FIX
go.dev/issue/42552 · REPORT
groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ · WEB
groups.google.com/g/golang-nuts/c/c-ssaaS7RMI · Release Notes
lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd%40%3Cissues.trafficcontrol.apache.org%3E
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO
security.netapp.com/advisory/ntap-20201202-0004 · Third Party Advisory
arista.com/en/support/advisories-notices/security-advisories/12166-security-advisory-62

More vulnerabilities in stdlib

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free