CVE-2022-28131

CVE-2022-28131 is a high-severity vulnerability affecting the encoding/xml package in Go versions prior to 1.17.12 and 1.18.4, as well as various Fedora and NetApp products utilizing these Go versions. This flaw, categorized as uncontrolled recursion (CWE-674), allows an unauthenticated attacker to trigger a denial-of-service condition through stack exhaustion by providing a deeply nested XML document. While rated with a CVSS score of 7.5, indicating a high impact on availability, there is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.