CVE-2024-34156: Stack exhaustion in Decoder.Decode in encoding/gob

Deferred

AliasesRHEA-2024:4866RHSA-2024:11216RHSA-2024:11217+2783 more

Published 06-09-2024Last modified 26-09-2024

Vulnerability summary

CVE-2024-34156 is a high (CVSS 7.5) vulnerability in go standard library encoding/gob. EPSS estimates a 1.13% chance of exploitation in the next 30 days, higher than 66.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.13%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 41 · Related 867

MGASA-2024-0376 OPENSUSE-SU-2024:14323-1 OPENSUSE-SU-2024:14324-1 OPENSUSE-SU-2025:0056-1 RHSA-2024:6908 RHSA-2024:6912+94 more

Showing 100 of 868.

Timeline

06-09-2024
PublishedVulnerability first disclosed.
26-09-2024
Last modifiedVulnerability information updated.

Description

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

1.13%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r18
actions-runner-controller< 0.9.3-r2
actions-runner-controller-compat< 0.9.3-r2
actions-runner-controller-fips< 0.9.3-r2
actions-runner-controller-fips-compat< 0.9.3-r2

addon-resizer< 1.8.22-r2
addon-resizer-compat< 1.8.22-r2
addon-resizer-fips< 1.8.22-r2
addon-resizer-fips-compat< 1.8.22-r2
age< 1.2.0-r2
amass< 4.2.0-r13
apache-beam-java-11-sdk< 2.63.0-r1
apache-beam-java-17-sdk< 2.63.0-r1
apache-beam-java-21-sdk< 2.63.0-r1
apache-beam-java-sdk< 2.63.0-r1
apache-beam-python-3.11-sdk< 2.58.1-r1
apko< 0.18.0-r0
argo-cd-2.11< 2.11.8-r0
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.6.5-r2
atlantis< 0.29.0-r1
atlantis-fips< 0.29.0-r1
authservice< 1.0.2-r0
authservice-fips< 1.0.1-r2
authservice-fips-compat< 1.0.1-r2
aws-ebs-csi-driver< 1.34.0-r1
aws-efs-csi-driver< 2.0.7-r1
aws-efs-csi-driver-fips< 2.0.7-r1
aws-flb-cloudwatch< 1.9.4-r13
aws-flb-cloudwatch-compat< 1.9.4-r13
aws-flb-cloudwatch-compat-fips< 1.9.4-r6
aws-flb-cloudwatch-fips< 1.9.4-r6
aws-flb-firehose< 1.7.2-r13
aws-flb-firehose-compat< 1.7.2-r13
aws-flb-firehose-compat-fips< 1.7.2-r6
aws-flb-firehose-fips< 1.7.2-r6
aws-flb-kinesis< 1.10.2-r14
aws-flb-kinesis-compat< 1.10.2-r14
aws-flb-kinesis-compat-fips< 1.10.2-r7
aws-flb-kinesis-fips< 1.10.2-r7
aws-load-balancer-controller< 2.8.2-r1
aws-load-balancer-controller-compat< 2.8.2-r1
aws-load-balancer-controller-fips< 2.8.2-r2
aws-network-policy-agent< 1.1.2-r2
aws-network-policy-agent-compat< 1.1.2-r2
azcopy< 10.26.0-r1
azcopy-fips< 10.26.0-r1
azure-aad-pod-identity-mic< 1.8.17-r12
azure-aad-pod-identity-nmi< 1.8.17-r12
bank-vaults< 1.20.4-r18
bank-vaults-fips< 1.20.4-r15
bank-vaults-template< 1.20.4-r18
bank-vaults-template-fips< 1.20.4-r15
bazelisk< 1.21.0-r0
bom< 0.6.0-r10
boring-registry< 0.15.2-r1
boring-registry-fips< 0.15.2-r1
buf< 1.40.1-r0
buildah< 1.37.2-r1
buildctl< 0.20.1-r3
buildkitd< 0.20.1-r3
caddy< 2.8.4-r3
caddy-fips< 2.8.4-r3
caddy-man< 2.8.4-r3
caddy-src< 2.8.4-r3
cadvisor< 0.50.0-r3
cadvisor-compat< 0.50.0-r3
cadvisor-fips< 0.50.0-r2
capslock< 0.2.5-r0
cass-operator< 1.22.2-r0
cass-operator-compat< 1.22.2-r0
cass-operator-compat-fips< 1.23.2-r0
cass-operator-config< 1.22.2-r0
cass-operator-fips< 1.23.2-r0
cass-operator-fips-no-pvc-delete< 1.22.1-r1
cass-operator-fips-no-pvc-delete-compat< 1.22.1-r1
cert-exporter< 2.13.0-r1
cert-exporter-fips< 2.13.0-r1
cert-manager-cmctl< 2.1.1-r0
cert-manager-cmctl-fips< 2.1.1-r0
cert-manager-webhook-pdns< 2.5.1-r6
cert-manager-webhook-pdns-fips< 2.5.1-r8
certificate-transparency< 1.2.1-r4
certificate-transparency-fips< 1.2.1-r4
certificate-transparency-fips-trillian-ctserver< 1.2.1-r4
certificate-transparency-trillian-ctserver< 1.2.1-r4
cfssl< 1.6.5-r9
cfssl-bundle< 1.6.5-r9
cfssl-bundle-fips< 1.6.5-r3
cfssl-certinfo< 1.6.5-r9
cfssl-certinfo-fips< 1.6.5-r3
cfssl-fips< 1.6.5-r3
cfssl-json< 1.6.5-r9
cfssl-json-fips< 1.6.5-r3
cfssl-mkbundle< 1.6.5-r9
cfssl-mkbundle-fips< 1.6.5-r3
cfssl-multirootca< 1.6.5-r9
cfssl-multirootca-fips< 1.6.5-r3
cfssl-newkey< 1.6.5-r9
cfssl-newkey-fips< 1.6.5-r3
cfssl-scan< 1.6.5-r9
cfssl-scan-fips< 1.6.5-r3
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r6
chartmuseum-fips< 0.16.2-r4
chezmoi< 2.52.2-r0
cilium-1.15< 1.15.8-r2
cilium-1.15-clustermesh-apiserver< 1.15.8-r2
cilium-1.15-container-init< 1.15.8-r2
cilium-1.15-container-init-compat< 1.15.8-r2
cilium-1.15-hubble-relay< 1.15.8-r2
cilium-1.15-iptables< 1.15.8-r2
cilium-1.15-operator-aws< 1.15.8-r2
cilium-1.15-operator-generic< 1.15.8-r2
cilium-1.16< 1.16.1-r2
cilium-1.16-clustermesh-apiserver< 1.16.1-r2
cilium-1.16-container-init< 1.16.1-r2
cilium-1.16-container-init-compat< 1.16.1-r2
cilium-1.16-hubble-relay< 1.16.1-r2
cilium-1.16-iptables< 1.16.1-r2
cilium-1.16-operator-aws< 1.16.1-r2
cilium-1.16-operator-generic< 1.16.1-r2
cilium-cli< 0.16.17-r0
cilium-fips-1.15< 1.15.8-r1
cilium-fips-1.15-clustermesh-apiserver< 1.15.8-r1
cilium-fips-1.15-container-init< 1.15.8-r1
cilium-fips-1.15-container-init-compat< 1.15.8-r1
cilium-fips-1.15-host-utils< 1.15.8-r1
cilium-fips-1.15-hubble-relay< 1.15.8-r1
cilium-fips-1.15-operator-aws< 1.15.8-r1
cilium-fips-1.15-operator-azure< 1.15.8-r1
cilium-fips-1.15-operator-generic< 1.15.8-r1
cilium-fips-1.16< 1.16.1-r1
cilium-fips-1.16-clustermesh-apiserver< 1.16.1-r1
cilium-fips-1.16-container-init< 1.16.1-r1
cilium-fips-1.16-container-init-compat< 1.16.1-r1
cilium-fips-1.16-host-utils< 1.16.1-r1
cilium-fips-1.16-hubble-relay< 1.16.1-r1
cilium-fips-1.16-operator-aws< 1.16.1-r1
cilium-fips-1.16-operator-azure< 1.16.1-r1
cilium-fips-1.16-operator-generic< 1.16.1-r1
cloud-sql-proxy-fips< 2.12.0-r1
cloud-sql-proxy-fips-compat< 2.12.0-r1
cloudflared< 2024.1.0-r13
cloudnative-pg< 1.24.0-r1
cloudnative-pg-fips< 1.24.0-r1
cloudnative-pg-fips-plugins< 1.24.0-r1
cloudnative-pg-plugins< 1.24.0-r1
cluster-proportional-autoscaler< 1.8.11-r9
cluster-proportional-autoscaler-compat< 1.8.11-r9
cni-plugins< 1.5.1-r2
cni-plugins-aws-k8s-compat< 1.5.1-r2
cni-plugins-bandwidth< 1.5.1-r2
cni-plugins-bandwidth-compat< 1.5.1-r2
cni-plugins-bridge< 1.5.1-r2
cni-plugins-bridge-compat< 1.5.1-r2
cni-plugins-dhcp< 1.5.1-r2
cni-plugins-dhcp-compat< 1.5.1-r2
cni-plugins-dummy< 1.5.1-r2
cni-plugins-dummy-compat< 1.5.1-r2
cni-plugins-fips< 1.5.1-r2
cni-plugins-fips-bandwidth< 1.5.1-r2
cni-plugins-fips-bandwidth-compat< 1.5.1-r2
cni-plugins-fips-bridge< 1.5.1-r2
cni-plugins-fips-bridge-compat< 1.5.1-r2
cni-plugins-fips-dhcp< 1.5.1-r2
cni-plugins-fips-dhcp-compat< 1.5.1-r2
cni-plugins-fips-dummy< 1.5.1-r2
cni-plugins-fips-dummy-compat< 1.5.1-r2
cni-plugins-fips-firewall< 1.5.1-r2
cni-plugins-fips-firewall-compat< 1.5.1-r2
cni-plugins-fips-host-device< 1.5.1-r2
cni-plugins-fips-host-device-compat< 1.5.1-r2
cni-plugins-fips-host-local< 1.5.1-r2
cni-plugins-fips-host-local-compat< 1.5.1-r2
cni-plugins-fips-ipam< 1.5.1-r2
cni-plugins-fips-ipvlan< 1.5.1-r2
cni-plugins-fips-ipvlan-compat< 1.5.1-r2
cni-plugins-fips-loopback< 1.5.1-r2
cni-plugins-fips-loopback-compat< 1.5.1-r2
cni-plugins-fips-macvlan< 1.5.1-r2
cni-plugins-fips-macvlan-compat< 1.5.1-r2
cni-plugins-fips-main< 1.5.1-r2
cni-plugins-fips-meta< 1.5.1-r2
cni-plugins-fips-portmap< 1.5.1-r2
cni-plugins-fips-portmap-compat< 1.5.1-r2
cni-plugins-fips-ptp< 1.5.1-r2
cni-plugins-fips-ptp-compat< 1.5.1-r2
cni-plugins-fips-sbr< 1.5.1-r2
cni-plugins-fips-sbr-compat< 1.5.1-r2
cni-plugins-fips-static< 1.5.1-r2
cni-plugins-fips-static-compat< 1.5.1-r2
cni-plugins-fips-tuning< 1.5.1-r2
cni-plugins-fips-tuning-compat< 1.5.1-r2
cni-plugins-fips-vlan< 1.5.1-r2
cni-plugins-fips-vlan-compat< 1.5.1-r2
cni-plugins-firewall< 1.5.1-r2
cni-plugins-firewall-compat< 1.5.1-r2
cni-plugins-host-device< 1.5.1-r2

Show all 199

Alpine1 product

go< 1.22.7-r0 | < 1.23.1-r0

2 vendors · 200 products · Showing 200 of 2306

References

108 links

go.dev/cl/611239ARTICLEREPORTFIX
go.dev/issue/69139ARTICLEREPORT
groups.google.com/g/golang-dev/c/S9POB9NCTdkARTICLEREPORTWEB
pkg.go.dev/vuln/GO-2024-3106AdvisoryREPORT
security.netapp.com/advisory/ntap-20240926-0004/
access.redhat.com/errata/RHEA-2024:4866Advisory
docs.redhat.com/en/documentation/red_hat_service_interconnect/1.4ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhea-2024_4866.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-34156REPORT
bugzilla.redhat.com/show_bug.cgi?id=2310528REPORT

Show all 100 references

Showing 100 of 108.