GO-2024-3106
Stack exhaustion in Decoder.Decode in encoding/gob
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-34156
- Alias
- BIT-golang-2024-34156
Description
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.22.7, introduced 1.23.0-0, fixed 1.23.1 |
Références
- https://go.dev/cl/611239 FIX
- https://go.dev/issue/69139 REPORT
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |