CVE-2024-34155: Stack exhaustion in all Parse functions in go/parser

Deferred

AliasesUBUNTU-CVE-2024-34155DEBIAN-CVE-2024-34155CGA-2275-fmp2-pg28+2739 more

Published 06-09-2024Last modified 04-11-2024

Vulnerability summary

CVE-2024-34155 is a medium (CVSS 4.3) vulnerability in go standard library go/parser. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.84%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 36 · Related 861

MGASA-2024-0376 OPENSUSE-SU-2024:14323-1 OPENSUSE-SU-2024:14324-1 OPENSUSE-SU-2025:0056-1 RHSA-2024:6908 RHSA-2024:6913+94 more

Showing 100 of 862.

Timeline

06-09-2024
PublishedVulnerability first disclosed.
04-11-2024
Last modifiedVulnerability information updated.

Description

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

CVSS metrics

5 scores · 5 sources · 1 version

v3.14.3

EPSS trend

Probability

0.84%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.84% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r18
actions-runner-controller< 0.9.3-r2
actions-runner-controller-compat< 0.9.3-r2
actions-runner-controller-fips< 0.9.3-r2
actions-runner-controller-fips-compat< 0.9.3-r2

addon-resizer< 1.8.22-r2
addon-resizer-compat< 1.8.22-r2
addon-resizer-fips< 1.8.22-r2
addon-resizer-fips-compat< 1.8.22-r2
age< 1.2.0-r2
amass< 4.2.0-r13
apache-beam-java-11-sdk< 2.63.0-r1
apache-beam-java-17-sdk< 2.63.0-r1
apache-beam-java-21-sdk< 2.63.0-r1
apache-beam-java-sdk< 2.63.0-r1
apache-beam-python-3.11-sdk< 2.58.1-r1
apko< 0.18.0-r0
argo-cd-2.11< 2.11.8-r0
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.6.5-r2
atlantis< 0.29.0-r1
atlantis-fips< 0.29.0-r1
authservice< 1.0.2-r0
authservice-fips< 1.0.1-r2
authservice-fips-compat< 1.0.1-r2
aws-ebs-csi-driver< 1.34.0-r1
aws-efs-csi-driver< 2.0.7-r1
aws-efs-csi-driver-fips< 2.0.7-r1
aws-flb-cloudwatch< 1.9.4-r13
aws-flb-cloudwatch-compat< 1.9.4-r13
aws-flb-cloudwatch-compat-fips< 1.9.4-r6
aws-flb-cloudwatch-fips< 1.9.4-r6
aws-flb-firehose< 1.7.2-r13
aws-flb-firehose-compat< 1.7.2-r13
aws-flb-firehose-compat-fips< 1.7.2-r6
aws-flb-firehose-fips< 1.7.2-r6
aws-flb-kinesis< 1.10.2-r14
aws-flb-kinesis-compat< 1.10.2-r14
aws-flb-kinesis-compat-fips< 1.10.2-r7
aws-flb-kinesis-fips< 1.10.2-r7
aws-load-balancer-controller< 2.8.2-r1
aws-load-balancer-controller-compat< 2.8.2-r1
aws-load-balancer-controller-fips< 2.8.2-r2
aws-network-policy-agent< 1.1.2-r2
aws-network-policy-agent-compat< 1.1.2-r2
azcopy< 10.26.0-r1
azcopy-fips< 10.26.0-r1
azure-aad-pod-identity-mic< 1.8.17-r12
azure-aad-pod-identity-nmi< 1.8.17-r12
bank-vaults< 1.20.4-r18
bank-vaults-fips< 1.20.4-r15
bank-vaults-template< 1.20.4-r18
bank-vaults-template-fips< 1.20.4-r15
bazelisk< 1.21.0-r0
bom< 0.6.0-r10
boring-registry< 0.15.2-r1
boring-registry-fips< 0.15.2-r1
buf< 1.40.1-r0
buildah< 1.37.2-r1
buildctl< 0.20.1-r3
buildkitd< 0.20.1-r3
caddy< 2.8.4-r3
caddy-fips< 2.8.4-r3
caddy-man< 2.8.4-r3
caddy-src< 2.8.4-r3
cadvisor< 0.50.0-r3
cadvisor-compat< 0.50.0-r3
cadvisor-fips< 0.50.0-r2
capslock< 0.2.5-r0
cass-operator< 1.22.2-r0
cass-operator-compat< 1.22.2-r0
cass-operator-compat-fips< 1.23.2-r0
cass-operator-config< 1.22.2-r0
cass-operator-fips< 1.23.2-r0
cass-operator-fips-no-pvc-delete< 1.22.1-r1
cass-operator-fips-no-pvc-delete-compat< 1.22.1-r1
cert-exporter< 2.13.0-r1
cert-exporter-fips< 2.13.0-r1
cert-manager-cmctl< 2.1.1-r0
cert-manager-cmctl-fips< 2.1.1-r0
cert-manager-webhook-pdns< 2.5.1-r6
cert-manager-webhook-pdns-fips< 2.5.1-r8
certificate-transparency< 1.2.1-r4
certificate-transparency-fips< 1.2.1-r4
certificate-transparency-fips-trillian-ctserver< 1.2.1-r4
certificate-transparency-trillian-ctserver< 1.2.1-r4
cfssl< 1.6.5-r9
cfssl-bundle< 1.6.5-r9
cfssl-bundle-fips< 1.6.5-r3
cfssl-certinfo< 1.6.5-r9
cfssl-certinfo-fips< 1.6.5-r3
cfssl-fips< 1.6.5-r3
cfssl-json< 1.6.5-r9
cfssl-json-fips< 1.6.5-r3
cfssl-mkbundle< 1.6.5-r9
cfssl-mkbundle-fips< 1.6.5-r3
cfssl-multirootca< 1.6.5-r9
cfssl-multirootca-fips< 1.6.5-r3
cfssl-newkey< 1.6.5-r9
cfssl-newkey-fips< 1.6.5-r3
cfssl-scan< 1.6.5-r9
cfssl-scan-fips< 1.6.5-r3
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r6
chartmuseum-fips< 0.16.2-r4
chezmoi< 2.52.2-r0
cilium-1.15< 1.15.8-r2
cilium-1.15-clustermesh-apiserver< 1.15.8-r2
cilium-1.15-container-init< 1.15.8-r2
cilium-1.15-container-init-compat< 1.15.8-r2
cilium-1.15-hubble-relay< 1.15.8-r2
cilium-1.15-iptables< 1.15.8-r2
cilium-1.15-operator-aws< 1.15.8-r2
cilium-1.15-operator-generic< 1.15.8-r2
cilium-1.16< 1.16.1-r2
cilium-1.16-clustermesh-apiserver< 1.16.1-r2
cilium-1.16-container-init< 1.16.1-r2
cilium-1.16-container-init-compat< 1.16.1-r2
cilium-1.16-hubble-relay< 1.16.1-r2
cilium-1.16-iptables< 1.16.1-r2
cilium-1.16-operator-aws< 1.16.1-r2
cilium-1.16-operator-generic< 1.16.1-r2
cilium-cli< 0.16.17-r0
cilium-fips-1.15< 1.15.8-r1
cilium-fips-1.15-clustermesh-apiserver< 1.15.8-r1
cilium-fips-1.15-container-init< 1.15.8-r1
cilium-fips-1.15-container-init-compat< 1.15.8-r1
cilium-fips-1.15-host-utils< 1.15.8-r1
cilium-fips-1.15-hubble-relay< 1.15.8-r1
cilium-fips-1.15-operator-aws< 1.15.8-r1
cilium-fips-1.15-operator-azure< 1.15.8-r1
cilium-fips-1.15-operator-generic< 1.15.8-r1
cilium-fips-1.16< 1.16.1-r1
cilium-fips-1.16-clustermesh-apiserver< 1.16.1-r1
cilium-fips-1.16-container-init< 1.16.1-r1
cilium-fips-1.16-container-init-compat< 1.16.1-r1
cilium-fips-1.16-host-utils< 1.16.1-r1
cilium-fips-1.16-hubble-relay< 1.16.1-r1
cilium-fips-1.16-operator-aws< 1.16.1-r1
cilium-fips-1.16-operator-azure< 1.16.1-r1
cilium-fips-1.16-operator-generic< 1.16.1-r1
cloud-sql-proxy-fips< 2.12.0-r1
cloud-sql-proxy-fips-compat< 2.12.0-r1
cloudflared< 2024.1.0-r13
cloudnative-pg< 1.24.0-r1
cloudnative-pg-fips< 1.24.0-r1
cloudnative-pg-fips-plugins< 1.24.0-r1
cloudnative-pg-plugins< 1.24.0-r1
cluster-proportional-autoscaler< 1.8.11-r9
cluster-proportional-autoscaler-compat< 1.8.11-r9
cni-plugins< 1.5.1-r2
cni-plugins-aws-k8s-compat< 1.5.1-r2
cni-plugins-bandwidth< 1.5.1-r2
cni-plugins-bandwidth-compat< 1.5.1-r2
cni-plugins-bridge< 1.5.1-r2
cni-plugins-bridge-compat< 1.5.1-r2
cni-plugins-dhcp< 1.5.1-r2
cni-plugins-dhcp-compat< 1.5.1-r2
cni-plugins-dummy< 1.5.1-r2
cni-plugins-dummy-compat< 1.5.1-r2
cni-plugins-fips< 1.5.1-r2
cni-plugins-fips-bandwidth< 1.5.1-r2
cni-plugins-fips-bandwidth-compat< 1.5.1-r2
cni-plugins-fips-bridge< 1.5.1-r2
cni-plugins-fips-bridge-compat< 1.5.1-r2
cni-plugins-fips-dhcp< 1.5.1-r2
cni-plugins-fips-dhcp-compat< 1.5.1-r2
cni-plugins-fips-dummy< 1.5.1-r2
cni-plugins-fips-dummy-compat< 1.5.1-r2
cni-plugins-fips-firewall< 1.5.1-r2
cni-plugins-fips-firewall-compat< 1.5.1-r2
cni-plugins-fips-host-device< 1.5.1-r2
cni-plugins-fips-host-device-compat< 1.5.1-r2
cni-plugins-fips-host-local< 1.5.1-r2
cni-plugins-fips-host-local-compat< 1.5.1-r2
cni-plugins-fips-ipam< 1.5.1-r2
cni-plugins-fips-ipvlan< 1.5.1-r2
cni-plugins-fips-ipvlan-compat< 1.5.1-r2
cni-plugins-fips-loopback< 1.5.1-r2
cni-plugins-fips-loopback-compat< 1.5.1-r2
cni-plugins-fips-macvlan< 1.5.1-r2
cni-plugins-fips-macvlan-compat< 1.5.1-r2
cni-plugins-fips-main< 1.5.1-r2
cni-plugins-fips-meta< 1.5.1-r2
cni-plugins-fips-portmap< 1.5.1-r2
cni-plugins-fips-portmap-compat< 1.5.1-r2
cni-plugins-fips-ptp< 1.5.1-r2
cni-plugins-fips-ptp-compat< 1.5.1-r2
cni-plugins-fips-sbr< 1.5.1-r2
cni-plugins-fips-sbr-compat< 1.5.1-r2
cni-plugins-fips-static< 1.5.1-r2
cni-plugins-fips-static-compat< 1.5.1-r2
cni-plugins-fips-tuning< 1.5.1-r2
cni-plugins-fips-tuning-compat< 1.5.1-r2
cni-plugins-fips-vlan< 1.5.1-r2
cni-plugins-fips-vlan-compat< 1.5.1-r2
cni-plugins-firewall< 1.5.1-r2
cni-plugins-firewall-compat< 1.5.1-r2
cni-plugins-host-device< 1.5.1-r2

Show all 199

Alpine1 product

go< 1.22.7-r0 | < 1.23.1-r0

2 vendors · 200 products · Showing 200 of 2203

References

18 links

Show all 18 references

ubuntu.com/security/notices/USN-7081-1Advisory
ubuntu.com/security/notices/USN-7109-1Advisory
ubuntu.com/security/notices/USN-7111-1Advisory
security-tracker.debian.org/tracker/CVE-2024-34155Advisory
lists.opensuse.org/archives/…Advisory
www.suse.com/security/cve/CVE-2024-34155WEB
nvd.nist.gov/vuln/detail/CVE-2024-34155OvalAdvisory
security.alpinelinux.org/vuln/CVE-2024-34155Advisory