CVE-2023-0475
CVE-2023-0475 is a medium-severity vulnerability in Hashicorp Go-getter with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.
Key facts
- Severity: Medium (CVSS 3.x base score 4.2)
- EPSS exploit prediction: 0% (36th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-409
- Affected product: Hashicorp Go-getter
- Published:
- Last modified:
Description
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
Frequently asked questions
- What is CVE-2023-0475?
- HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
- How severe is CVE-2023-0475?
- CVE-2023-0475 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2023-0475 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-0475?
- CVE-2023-0475 primarily affects Hashicorp Go-getter. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-0475?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-0475 published?
- CVE-2023-0475 was published on 2023-02-16 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*
- cpe:2.3:a:hashicorp:go-getter:2.1.1:*:*:*:*:*:*:*
More vulnerabilities in Hashicorp Go-getter
- CVE-2024-3817 — Critical (CVSS 9.8): HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.…
- CVE-2022-26945 — Critical (CVSS 9.8): go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of…
- CVE-2022-30323 — High (CVSS 8.6): go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.
- CVE-2022-30322 — High (CVSS 8.6): go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP…
- CVE-2022-30321 — High (CVSS 8.6): go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and…
- CVE-2024-6257 — High (CVSS 8.4): HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git…
All CVEs affecting Hashicorp Go-getter →
Other CWE-409 vulnerabilities
- CVE-2026-55195 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…
- CVE-2026-53430 — High (CVSS 8.7): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc…
- CVE-2026-44697 — High (CVSS 8.6): Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated…
- CVE-2026-49755 — High (CVSS 8.2): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows…
- CVE-2026-48594 — High (CVSS 8.2): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of…
- CVE-2026-43970 — High (CVSS 8.2): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows…