CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint

Deferred

AliasesUBUNTU-CVE-2024-34158DEBIAN-CVE-2024-34158CGA-222r-2v3m-phf7+2738 more

Published 06-09-2024Last modified 04-10-2024

Vulnerability summary

CVE-2024-34158 is a high (CVSS 7.5) Uncontrolled Recursion vulnerability in go standard library go/build/constraint. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 64.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.05%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 37 · Related 862

MGASA-2024-0376 OPENSUSE-SU-2024:14323-1 OPENSUSE-SU-2024:14324-1 OPENSUSE-SU-2025:0056-1 RHSA-2024:6908 RHSA-2024:6913+94 more

Showing 100 of 863.

Timeline

06-09-2024
PublishedVulnerability first disclosed.
04-10-2024
Last modifiedVulnerability information updated.

Description

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

1.05%

Chance of exploitation in the next 30 days

Percentile

64%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.05% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r18
actions-runner-controller< 0.9.3-r2
actions-runner-controller-compat< 0.9.3-r2
actions-runner-controller-fips< 0.9.3-r2
actions-runner-controller-fips-compat< 0.9.3-r2

addon-resizer< 1.8.22-r2
addon-resizer-compat< 1.8.22-r2
addon-resizer-fips< 1.8.22-r2
addon-resizer-fips-compat< 1.8.22-r2
age< 1.2.0-r2
amass< 4.2.0-r13
apache-beam-java-11-sdk< 2.63.0-r1
apache-beam-java-17-sdk< 2.63.0-r1
apache-beam-java-21-sdk< 2.63.0-r1
apache-beam-java-sdk< 2.63.0-r1
apache-beam-python-3.11-sdk< 2.58.1-r1
apko< 0.18.0-r0
argo-cd-2.11< 2.11.8-r0
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.6.5-r2
atlantis< 0.29.0-r1
atlantis-fips< 0.29.0-r1
authservice< 1.0.2-r0
authservice-fips< 1.0.1-r2
authservice-fips-compat< 1.0.1-r2
aws-ebs-csi-driver< 1.34.0-r1
aws-efs-csi-driver< 2.0.7-r1
aws-efs-csi-driver-fips< 2.0.7-r1
aws-flb-cloudwatch< 1.9.4-r13
aws-flb-cloudwatch-compat< 1.9.4-r13
aws-flb-cloudwatch-compat-fips< 1.9.4-r6
aws-flb-cloudwatch-fips< 1.9.4-r6
aws-flb-firehose< 1.7.2-r13
aws-flb-firehose-compat< 1.7.2-r13
aws-flb-firehose-compat-fips< 1.7.2-r6
aws-flb-firehose-fips< 1.7.2-r6
aws-flb-kinesis< 1.10.2-r14
aws-flb-kinesis-compat< 1.10.2-r14
aws-flb-kinesis-compat-fips< 1.10.2-r7
aws-flb-kinesis-fips< 1.10.2-r7
aws-load-balancer-controller< 2.8.2-r1
aws-load-balancer-controller-compat< 2.8.2-r1
aws-load-balancer-controller-fips< 2.8.2-r2
aws-network-policy-agent< 1.1.2-r2
aws-network-policy-agent-compat< 1.1.2-r2
azcopy< 10.26.0-r1
azcopy-fips< 10.26.0-r1
azure-aad-pod-identity-mic< 1.8.17-r12
azure-aad-pod-identity-nmi< 1.8.17-r12
bank-vaults< 1.20.4-r18
bank-vaults-fips< 1.20.4-r15
bank-vaults-template< 1.20.4-r18
bank-vaults-template-fips< 1.20.4-r15
bazelisk< 1.21.0-r0
bom< 0.6.0-r10
boring-registry< 0.15.2-r1
boring-registry-fips< 0.15.2-r1
buf< 1.40.1-r0
buildah< 1.37.2-r1
buildctl< 0.20.1-r3
buildkitd< 0.20.1-r3
caddy< 2.8.4-r3
caddy-fips< 2.8.4-r3
caddy-man< 2.8.4-r3
caddy-src< 2.8.4-r3
cadvisor< 0.50.0-r3
cadvisor-compat< 0.50.0-r3
cadvisor-fips< 0.50.0-r2
capslock< 0.2.5-r0
cass-operator< 1.22.2-r0
cass-operator-compat< 1.22.2-r0
cass-operator-compat-fips< 1.23.2-r0
cass-operator-config< 1.22.2-r0
cass-operator-fips< 1.23.2-r0
cass-operator-fips-no-pvc-delete< 1.22.1-r1
cass-operator-fips-no-pvc-delete-compat< 1.22.1-r1
cert-exporter< 2.13.0-r1
cert-exporter-fips< 2.13.0-r1
cert-manager-cmctl< 2.1.1-r0
cert-manager-cmctl-fips< 2.1.1-r0
cert-manager-webhook-pdns< 2.5.1-r6
cert-manager-webhook-pdns-fips< 2.5.1-r8
certificate-transparency< 1.2.1-r4
certificate-transparency-fips< 1.2.1-r4
certificate-transparency-fips-trillian-ctserver< 1.2.1-r4
certificate-transparency-trillian-ctserver< 1.2.1-r4
cfssl< 1.6.5-r9
cfssl-bundle< 1.6.5-r9
cfssl-bundle-fips< 1.6.5-r3
cfssl-certinfo< 1.6.5-r9
cfssl-certinfo-fips< 1.6.5-r3
cfssl-fips< 1.6.5-r3
cfssl-json< 1.6.5-r9
cfssl-json-fips< 1.6.5-r3
cfssl-mkbundle< 1.6.5-r9
cfssl-mkbundle-fips< 1.6.5-r3
cfssl-multirootca< 1.6.5-r9
cfssl-multirootca-fips< 1.6.5-r3
cfssl-newkey< 1.6.5-r9
cfssl-newkey-fips< 1.6.5-r3
cfssl-scan< 1.6.5-r9
cfssl-scan-fips< 1.6.5-r3
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r6
chartmuseum-fips< 0.16.2-r4
chezmoi< 2.52.2-r0
cilium-1.15< 1.15.8-r2
cilium-1.15-clustermesh-apiserver< 1.15.8-r2
cilium-1.15-container-init< 1.15.8-r2
cilium-1.15-container-init-compat< 1.15.8-r2
cilium-1.15-hubble-relay< 1.15.8-r2
cilium-1.15-iptables< 1.15.8-r2
cilium-1.15-operator-aws< 1.15.8-r2
cilium-1.15-operator-generic< 1.15.8-r2
cilium-1.16< 1.16.1-r2
cilium-1.16-clustermesh-apiserver< 1.16.1-r2
cilium-1.16-container-init< 1.16.1-r2
cilium-1.16-container-init-compat< 1.16.1-r2
cilium-1.16-hubble-relay< 1.16.1-r2
cilium-1.16-iptables< 1.16.1-r2
cilium-1.16-operator-aws< 1.16.1-r2
cilium-1.16-operator-generic< 1.16.1-r2
cilium-cli< 0.16.17-r0
cilium-fips-1.15< 1.15.8-r1
cilium-fips-1.15-clustermesh-apiserver< 1.15.8-r1
cilium-fips-1.15-container-init< 1.15.8-r1
cilium-fips-1.15-container-init-compat< 1.15.8-r1
cilium-fips-1.15-host-utils< 1.15.8-r1
cilium-fips-1.15-hubble-relay< 1.15.8-r1
cilium-fips-1.15-operator-aws< 1.15.8-r1
cilium-fips-1.15-operator-azure< 1.15.8-r1
cilium-fips-1.15-operator-generic< 1.15.8-r1
cilium-fips-1.16< 1.16.1-r1
cilium-fips-1.16-clustermesh-apiserver< 1.16.1-r1
cilium-fips-1.16-container-init< 1.16.1-r1
cilium-fips-1.16-container-init-compat< 1.16.1-r1
cilium-fips-1.16-host-utils< 1.16.1-r1
cilium-fips-1.16-hubble-relay< 1.16.1-r1
cilium-fips-1.16-operator-aws< 1.16.1-r1
cilium-fips-1.16-operator-azure< 1.16.1-r1
cilium-fips-1.16-operator-generic< 1.16.1-r1
cloud-sql-proxy-fips< 2.12.0-r1
cloud-sql-proxy-fips-compat< 2.12.0-r1
cloudflared< 2024.1.0-r13
cloudnative-pg< 1.24.0-r1
cloudnative-pg-fips< 1.24.0-r1
cloudnative-pg-fips-plugins< 1.24.0-r1
cloudnative-pg-plugins< 1.24.0-r1
cluster-proportional-autoscaler< 1.8.11-r9
cluster-proportional-autoscaler-compat< 1.8.11-r9
cni-plugins< 1.5.1-r2
cni-plugins-aws-k8s-compat< 1.5.1-r2
cni-plugins-bandwidth< 1.5.1-r2
cni-plugins-bandwidth-compat< 1.5.1-r2
cni-plugins-bridge< 1.5.1-r2
cni-plugins-bridge-compat< 1.5.1-r2
cni-plugins-dhcp< 1.5.1-r2
cni-plugins-dhcp-compat< 1.5.1-r2
cni-plugins-dummy< 1.5.1-r2
cni-plugins-dummy-compat< 1.5.1-r2
cni-plugins-fips< 1.5.1-r2
cni-plugins-fips-bandwidth< 1.5.1-r2
cni-plugins-fips-bandwidth-compat< 1.5.1-r2
cni-plugins-fips-bridge< 1.5.1-r2
cni-plugins-fips-bridge-compat< 1.5.1-r2
cni-plugins-fips-dhcp< 1.5.1-r2
cni-plugins-fips-dhcp-compat< 1.5.1-r2
cni-plugins-fips-dummy< 1.5.1-r2
cni-plugins-fips-dummy-compat< 1.5.1-r2
cni-plugins-fips-firewall< 1.5.1-r2
cni-plugins-fips-firewall-compat< 1.5.1-r2
cni-plugins-fips-host-device< 1.5.1-r2
cni-plugins-fips-host-device-compat< 1.5.1-r2
cni-plugins-fips-host-local< 1.5.1-r2
cni-plugins-fips-host-local-compat< 1.5.1-r2
cni-plugins-fips-ipam< 1.5.1-r2
cni-plugins-fips-ipvlan< 1.5.1-r2
cni-plugins-fips-ipvlan-compat< 1.5.1-r2
cni-plugins-fips-loopback< 1.5.1-r2
cni-plugins-fips-loopback-compat< 1.5.1-r2
cni-plugins-fips-macvlan< 1.5.1-r2
cni-plugins-fips-macvlan-compat< 1.5.1-r2
cni-plugins-fips-main< 1.5.1-r2
cni-plugins-fips-meta< 1.5.1-r2
cni-plugins-fips-portmap< 1.5.1-r2
cni-plugins-fips-portmap-compat< 1.5.1-r2
cni-plugins-fips-ptp< 1.5.1-r2
cni-plugins-fips-ptp-compat< 1.5.1-r2
cni-plugins-fips-sbr< 1.5.1-r2
cni-plugins-fips-sbr-compat< 1.5.1-r2
cni-plugins-fips-static< 1.5.1-r2
cni-plugins-fips-static-compat< 1.5.1-r2
cni-plugins-fips-tuning< 1.5.1-r2
cni-plugins-fips-tuning-compat< 1.5.1-r2
cni-plugins-fips-vlan< 1.5.1-r2
cni-plugins-fips-vlan-compat< 1.5.1-r2
cni-plugins-firewall< 1.5.1-r2
cni-plugins-firewall-compat< 1.5.1-r2
cni-plugins-host-device< 1.5.1-r2

Show all 199

Alpine1 product

go< 1.22.7-r0 | < 1.23.1-r0

2 vendors · 200 products · Showing 200 of 2202

References

16 links

Show all 16 references

ubuntu.com/security/notices/USN-7081-1Advisory
ubuntu.com/security/notices/USN-7109-1Advisory
ubuntu.com/security/notices/USN-7111-1Advisory
security-tracker.debian.org/tracker/CVE-2024-34158Advisory
nvd.nist.gov/vuln/detail/CVE-2024-34158OvalAdvisory
security.alpinelinux.org/vuln/CVE-2024-34158Advisory