encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

🗓️ 02 Oct 2024 00:37:30Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

A flaw in the encoding gob package can panic decoding nested messages, causing stack exhaustion.

Reporter	Title	Published	Views	Family All 1520
ibm	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
ibm	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Golang Go denial of service vulnerabilitiy(CVE-2024-34156)	28 Jan 202521:51	–	ibm
ibm	Security Bulletin: IBM DataPower Operator vulnerable to DoS due to use of Go (CVE-2024-34155, CVE-2024-34156)	28 Jan 202522:08	–	ibm
ibm	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	17 Mar 202510:56	–	ibm
ibm	Security Bulletin: IBM Storage Ceph contains vulnerabilities found in Golang (CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2024-24788 CVE-2024-24789 CVE-2024-24790 CVE-2024-6104 CVE-2024-24791 CVE-2024-34155 CVE-2024-34156)	7 Jul 202520:03	–	ibm
ibm	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	25 Sep 202413:30	–	ibm
ibm	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	7 Mar 202516:09	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	19 Dec 202416:32	–	ibm
ibm	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for Junuary 2025.	7 Feb 202518:48	–	ibm
ibm	Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Golang Go (CVE-2024-34158, CVE-2024-34155, CVE-2024-34156).	1 Apr 202503:37	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8.6	x86_64	delve	1.7.2-1.module+el8.6.0+12972+ebab5911	delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64.rpm
Red Hat Enterprise Linux	8.6	x86_64	delve-debuginfo	1.7.2-1.module+el8.6.0+12972+ebab5911	delve-debuginfo-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64.rpm
Red Hat Enterprise Linux	8.6	x86_64	delve-debugsource	1.7.2-1.module+el8.6.0+12972+ebab5911	delve-debugsource-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64.rpm
Red Hat Enterprise Linux	8.6	aarch64	go-toolset	1.17.13-1.module+el8.6.0+21758+c87a29d6	go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.aarch64.rpm
Red Hat Enterprise Linux	8.6	ppc64le	go-toolset	1.17.13-1.module+el8.6.0+21758+c87a29d6	go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.ppc64le.rpm
Red Hat Enterprise Linux	8.6	s390x	go-toolset	1.17.13-1.module+el8.6.0+21758+c87a29d6	go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.s390x.rpm
Red Hat Enterprise Linux	8.6	x86_64	go-toolset	1.17.13-1.module+el8.6.0+21758+c87a29d6	go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.x86_64.rpm
Red Hat Enterprise Linux	8.6	aarch64	golang	1.17.13-4.module+el8.6.0+22322+30527ab0	golang-1.17.13-4.module+el8.6.0+22322+30527ab0.aarch64.rpm
Red Hat Enterprise Linux	8.6	ppc64le	golang	1.17.13-4.module+el8.6.0+22322+30527ab0	golang-1.17.13-4.module+el8.6.0+22322+30527ab0.ppc64le.rpm
Red Hat Enterprise Linux	8.6	s390x	golang	1.17.13-4.module+el8.6.0+22322+30527ab0	golang-1.17.13-4.module+el8.6.0+22322+30527ab0.s390x.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-34156
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/611239
go	www.go.dev/issue/69139
groups	www.groups.google.com/g/golang-dev/c/S9POB9NCTdk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-34156
pkg	www.pkg.go.dev/vuln/GO-2024-3106
cve	www.cve.org/CVERecord

01 Jul 2026 13:59Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.01127

SSVC

encoding gob flaw decoder panic depth nested structures stack exhaustion Go standard library