VDB
Sign up
HIGH7.5

GO-2021-0347

Stack exhaustion when compiling deeply nested expressions in regexp

Quick fix

GO-2021-0347 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.16.15

Details

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib
Introduced in: 0Fixed in: 1.16.15
Fixgo get stdlib@v1.16.15

References