CVE-2024-34155 Stack exhaustion in all Parse functions in go/parser
Attackers can cause a denial of service by providing Go source code with deeply nested literals to the parser, leading to stack exhaustion and application panic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34155?
CVE-2024-34155 is a medium-severity denial of service vulnerability in go/parser, published on 6 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Which versions are affected by CVE-2024-34155?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.22.7, 1.23.1 |
stdlib Go | All versions | 1.22.7, 1.23.1 |
Linux distribution packages (1)
trivy openSUSE:Tumbleweed | All versions | 0.56.1-1.1 |
How do I fix CVE-2024-34155?
Upgrade golang to a fixed version for your release line: 1.22.7 or 1.23.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-34155 being exploited?
There is no known exploitation of CVE-2024-34155 in the wild and no public exploit code.
Sources
Also known as AZL-48896, AZL-78988, AZL-98886, BELL-CVE-2024-34155, BIT-golang-2024-34155, DEBIAN-CVE-2024-34155 and 8 more.