CVE-2024-34156

Stack exhaustion in Decoder.Decode in encoding/gob

View on CVE.org
Published Sep 6, 2024 CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Description
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-7081-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00178}

 epss

{'score': 0.00168}
Type Values Removed Values Added
CPEs cpe:/a:redhat:ceph_storage:8.1::el9
Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:6.1::el9
Vendors & Products Redhat ceph Storage
Type Values Removed Values Added
First Time appeared Redhat service Interconnect
CPEs cpe:/a:redhat:service_interconnect:1.4::el8
cpe:/a:redhat:service_interconnect:1.4::el9
Vendors & Products Redhat service Interconnect
Type Values Removed Values Added
First Time appeared Redhat openshift Custom Metrics Autoscaler
CPEs cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.15::el9
Vendors & Products Redhat openshift Custom Metrics Autoscaler
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_api_data_protection:1.4::el9
cpe:/a:redhat:openstack:17.1::el9
Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt
Type Values Removed Values Added
First Time appeared Redhat openstack
CPEs cpe:/a:redhat:openstack:16.2::el8
Vendors & Products Redhat openstack
Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.5::el8
Type Values Removed Values Added
First Time appeared Redhat openshift Devspaces
CPEs cpe:/a:redhat:openshift_devspaces:3::el8
Vendors & Products Redhat openshift Devspaces
Type Values Removed Values Added
First Time appeared Redhat openshift Api Data Protection
CPEs cpe:/a:redhat:openshift_api_data_protection:1.3::el9
Vendors & Products Redhat openshift Api Data Protection
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Security
Redhat openstack Podified
CPEs cpe:/a:redhat:advanced_cluster_security:4.4::el8
cpe:/a:redhat:openstack_podified:1.0::el9
Vendors & Products Redhat advanced Cluster Security
Redhat openstack Podified
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.14::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8
cpe:/a:redhat:openshift:4.12::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift:4.13::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.15::el8
cpe:/a:redhat:openshift:4.15::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el8
cpe:/a:redhat:openshift:4.16::el9
Type Values Removed Values Added
First Time appeared Redhat logging
CPEs cpe:/a:redhat:logging:5.6::el8
cpe:/a:redhat:logging:5.8::el9
cpe:/a:redhat:logging:5.9::el9
cpe:/a:redhat:logging:6.0::el9
Vendors & Products Redhat logging
Type Values Removed Values Added
First Time appeared Redhat openshift
CPEs cpe:/a:redhat:openshift:4.17::el8
cpe:/a:redhat:openshift:4.17::el9
Vendors & Products Redhat openshift
Type Values Removed Values Added
First Time appeared Redhat cryostat
CPEs cpe:/a:redhat:cryostat:3::el8
Vendors & Products Redhat cryostat
Type Values Removed Values Added
First Time appeared Redhat network Observ Optr
CPEs cpe:/a:redhat:network_observ_optr:1.7.0::el9
Vendors & Products Redhat network Observ Optr
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_tus:8.6
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_tus:8.4
Vendors & Products Redhat rhel Aus
Redhat rhel Tus
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.0
Vendors & Products Redhat rhel E4s
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Eus
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Eus
Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library encoding\/gob
CPEs cpe:2.3:a:go_standard_library:encoding\/gob:*:*:*:*:*:*:*:*
Vendors & Products Go Standard Library
Go Standard Library encoding\/gob
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-674
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important
Type Values Removed Values Added
Description Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Title Stack exhaustion in Decoder.Decode in encoding/gob
References
Earlier changes (24)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 26, 2024, 3:03 PM
Reserved
May 1, 2024, 6:45 PM

View source JSON

Updated
Sep 26, 2024, 3:03 PM

JSON

Status
Deferred
Published
Sep 6, 2024, 9:15 PM
Modified
Jun 17, 2026, 7:33 AM

View source JSON

Severity
Important
Public date
Sep 6, 2024, 9:15 PM

View source Bugzilla JSON

No data.