OESA-2024-2397 golang security update

🗓️ 15 Nov 2024 12:19:46Reported by GoogleType

osv🔗 osv.dev👁 9 Views

Go security update fixes panics from parsing nested literals or build tags, preventing stack exhaustion.

Reporter	Title	Published	Views	Family All 2042
RedhatCVE	CVE-2024-34155	7 Sep 202400:09	–	redhatcve
RedhatCVE	CVE-2024-34158	6 Sep 202423:42	–	redhatcve
RedHat Linux	go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion	8 Nov 202415:04	–	redhat
RedHat Linux	go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion	8 Nov 202415:04	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.2 for RHEL 9	2 Dec 202414:11	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: podman security update	12 Nov 202410:29	–	redhat
RedHat Linux	go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion	12 Nov 202410:29	–	redhat
RedHat Linux	go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion	12 Nov 202410:29	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: buildah security update	12 Nov 202410:25	–	redhat
RedHat Linux	go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion	12 Nov 202410:25	–	redhat

Source	Link
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-34155
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-34158

03 Sep 2025 06:20Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.01046

SSVC