CVE-2024-37298 Potential memory exhaustion attack due to sparse slice deserialization

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode on a struct that has a field of type struct... opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of...

CVE-2024-37298 Potential memory exhaustion attack due to sparse slice deserialization

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode on a struct that has a field of type struct... opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of...

CVE-2024-37298

CVE-2024-37298 affects gorilla/schema, describing a memory-exhaustion vulnerability in decoding structs with nested slices (specifically []struct{...}) via schema.Decoder.Decode() on pre-1.4.1. The issue arises from sparse slice deserialization leading to uncontrolled memory allocations. A fix is...

CVE-2024-37298

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode on a struct that has a field of type struct... opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of...

schema security vulnerability

schema is a library from gorilla open source. Converts structures to and from form values. A security vulnerability exists in schema versions prior to 1.4.1, which stems from vulnerability to a memory exhaustion vulnerability...

PT-2024-27455 · Unknown +5 · Gorilla/Schema +5

Name of the Vulnerable Software and Affected Versions: gorilla/schema versions prior to 1.4.1 Description: The issue concerns a memory exhaustion vulnerability in gorilla/schema. When schema.Decoder.Decode is run on a struct that has a field of type struct..., it opens up the possibility of...