CVE-2024-34155: Stack exhaustion in all Parse functions in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-1.23to a version that resolves this vulnerability.Fixed in 1.23.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34155?
CVE-2024-34155 has a severity that can lead to application crashes due to stack exhaustion.
How do I fix CVE-2024-34155?
To fix CVE-2024-34155, upgrade to golang-1.22 version 1.22.11-1 or golang-1.23 version 1.23.5-1.
What products are affected by CVE-2024-34155?
CVE-2024-34155 affects IBM Concert Software and multiple versions of Go, specifically golang-1.15, golang-1.19, golang-1.22, and golang-1.23.
Can CVE-2024-34155 cause security issues?
Yes, CVE-2024-34155 can lead to a denial of service due to application crashes under specific conditions.
How do I check if my software is vulnerable to CVE-2024-34155?
You can check if your software is vulnerable to CVE-2024-34155 by verifying if you are using the affected versions of Go and IBM Concert Software.