CVE-2024-34156

Stack exhaustion in Decoder.Decode in encoding/gob

High · published September 6, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01127 · 66.1th percentile
Published
2024-09-06T20:42Z
EPSS history
Timeline
  • 06 SEP 20:42Z
    Stack exhaustion in Decoder.Decode in encoding/gob
    cvelistv5