Data Amplification in HashiCorp go-getter

MEDIUM 6.5CVE-2023-0475 · GHSA-jpxj-2jvg-6jv9 · GO-2023-1578 · Published 16/02/2023 · updated 17/06/2026

In short

CVE-2023-0475 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/v2, go-getter (hashicorp).
Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 39.4% of all vulnerabilities.
Fix: update to 1.7.0, 2.2.0 or later.

Package	Affected versions	Patched versions
github.com/hashicorp/go-getter Go	`< 1.7.0`	`1.7.0`
github.com/hashicorp/go-getter/v2 Go	`≥ 2.0.0, < 2.2.0`	`2.2.0`
go-getter hashicorp	`= 2.1.1≤ 1.6.2`	No fix yet

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

NVD description

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.7.0

1.7.0

≥ 2.0.0, < 2.2.0

2.2.0

= 2.1.1≤ 1.6.2

No fix yet

More vulnerabilities in github.com/hashicorp/go-getter

See all →