CVE-2024-34156: Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Other sources
Golang Go is vulnerable to a denial of service, caused by a stack exhaustion in Decoder.Decode. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-1.23to a version that resolves this vulnerability.Fixed in 1.23.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34156?
CVE-2024-34156 is considered to be a medium severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2024-34156?
To remediate CVE-2024-34156, upgrade to golang-1.22 version 1.22.11-1 or golang-1.23 version 1.23.5-1.
Which software is affected by CVE-2024-34156?
CVE-2024-34156 affects IBM Concert Software versions up to 1.0.3 and specific versions of golang in Debian.
What mitigation strategies exist for CVE-2024-34156?
Mitigation can be achieved by limiting the depth of nested structures in messages processed by Decoder.Decode.
Is CVE-2024-34156 a follow-up to any previous vulnerabilities?
Yes, CVE-2024-34156 is a follow-up to CVE-2022-30635, relating to similar stack exhaustion issues.