What’s Vulnerable › Vulnerabilities

CVE-2023-0475: Go-Getter Vulnerable to Decompression Bombs

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-16 · updated 2026-06-17
• Weakness: CWE-409

Description

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Affected products

• HashiCorp go-getter: through 1.6.2; 2.1.1

References

• https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
• https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125

Get alerted when CVE-2023-0475 or the next vulnerability affects your stack