CVE-2023-0475: Hashicorp Go-Getter

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Affected products

• Hashicorp Go-Getter: up to and including 1.6.2; version 2.1.1 only

Published 2023-02-16. Last modified 2026-06-17.