CVE-2022-30633: 
Grafana vulnerability analysis and mitigation

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag (NVD, Go Vuln).

The vulnerability is tracked as CVE-2022-30633 with a CVSS v3.1 Base Score of 7.5 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is classified as CWE-674 (Uncontrolled Recursion) and affects the encoding/xml package in Go versions before 1.17.12 and from 1.18.0 to versions before 1.18.4 (NVD).

When exploited, this vulnerability can cause a denial of service through application panic due to stack exhaustion. The attack can be triggered when unmarshalling XML documents into Go structs that contain nested fields using the 'any' field tag (Go Announce).

The issue has been fixed in Go versions 1.17.12 and 1.18.4. Users are advised to upgrade to these or later versions. The fix implements limits on the depth of nesting in unmarshal operations to prevent stack exhaustion (Go Commit).