CVE-2024-37298: Potential memory exhaustion attack due to sparse slice deserialization

Vulnerability summary

CVE-2024-37298 is a high (CVSS 7.5) vulnerability in gorilla schema. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.2% of scored vulnerabilities.

Timeline

1. 01-07-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.