title: Panic when decoding Float and Rat types in math/big
description: A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
problem types: CWE 400: Uncontrolled Resource Consumption
affected:
{
vendor: Go standard library
product: math/big
collectionURL: https://pkg.go.dev
packageName: math/big
versions:
version: 0, lessThan: 1.17.13, status: affected, versionType: semver
version: 1.18.0-0, lessThan: 1.18.5, status: affected, versionType: semver
programRoutines:
name: Float.GobDecode
name: Rat.GobDecode
defaultStatus: unaffected
}