CVE-2022-28327: Fedoraproject Extra Packages For Enterprise Linux

High severity, CVSS 7.5. EPSS: 4.2% chance of exploitation in the next 30 days.

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: version 7.0 only; version 8.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Golang Go: before 1.17.9 (fixed in 1.17.9); from 1.18.0, before 1.18.1 (fixed in 1.18.1)

Published 2022-04-20. Last modified 2026-06-17.