CVE-2022-30633

CVE-2022-30633 is an uncontrolled recursion vulnerability in the encoding/xml package of Go, affecting versions before 1.17.12 and 1.18.4. An attacker can trigger a denial-of-service (DoS) condition by causing a stack exhaustion panic when unmarshalling a specially crafted XML document into a Go struct with a nested 'any' field tag. This high-severity vulnerability (CVSS 7.5) has a low attack complexity and can be exploited remotely over the network, leading to a complete loss of availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion or media coverage regarding this CVE.