CVE-2024-37298

2024-07-0119:15:04

CWE-770

[email protected]

web.nvd.nist.gov

gorilla/schema

memory exhaustion

vulnerability fix

version 1.4.1

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

Affected configurations

Vulners

Node

gorillaschemaRange<1.4.1

CNA Affected

[
  {
    "vendor": "gorilla",
    "product": "schema",
    "versions": [
      {
        "version": "< 1.4.1",
        "status": "affected"
      }
    ]
  }
]