go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

🗓️ 23 Oct 2024 05:52:08Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Flaw in go/build/constraint causes panic when parsing deeply nested // +build lines due to stack exhaustion.

Reporter	Title	Published	Views	Family All 1154
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	25 Sep 202413:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	7 Mar 202516:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Golang Go denial of service vulnerabilitiy( CVE-2024-34158)	28 Jan 202521:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	19 Dec 202416:32	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for Junuary 2025.	7 Feb 202518:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Golang Go (CVE-2024-34158, CVE-2024-34155, CVE-2024-34156).	1 Apr 202503:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	17 Jan 202509:14	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Angular.js, Golang Go, Java, MongoDB, Linux kernel may affect IBM Spectrum Protect Plus	26 Aug 202516:53	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	9 Oct 202409:25	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	podman	4:5.2.3-2.rhaos4.17.el8	podman-4:5.2.3-2.rhaos4.17.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	podman	4:5.2.3-2.rhaos4.17.el8	podman-4:5.2.3-2.rhaos4.17.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	podman	4:5.2.3-2.rhaos4.17.el8	podman-4:5.2.3-2.rhaos4.17.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	podman	4:5.2.3-2.rhaos4.17.el8	podman-4:5.2.3-2.rhaos4.17.el8.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	podman	4:5.2.3-2.rhaos4.17.el9	podman-4:5.2.3-2.rhaos4.17.el9.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	podman	4:5.2.3-2.rhaos4.17.el9	podman-4:5.2.3-2.rhaos4.17.el9.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	podman	4:5.2.3-2.rhaos4.17.el9	podman-4:5.2.3-2.rhaos4.17.el9.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	podman	4:5.2.3-2.rhaos4.17.el9	podman-4:5.2.3-2.rhaos4.17.el9.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	podman-catatonit	4:5.2.3-2.rhaos4.17.el8	podman-catatonit-4:5.2.3-2.rhaos4.17.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	podman-catatonit	4:5.2.3-2.rhaos4.17.el8	podman-catatonit-4:5.2.3-2.rhaos4.17.el8.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-34158
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/611240
go	www.go.dev/issue/69141
groups	www.groups.google.com/g/golang-dev/c/S9POB9NCTdk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-34158
pkg	www.pkg.go.dev/vuln/GO-2024-3107
cve	www.cve.org/CVERecord

01 Jul 2026 13:59Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.01046

SSVC

build constraint parse panic stack exhaustion nested expressions standard library go language