CVE-2024-34156
High · 7.5CVSS
7.5
EPSS
1.1%
Published
Sep 6, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
Attackers can crash certain applications by sending specially crafted data, causing service outages until the software is restarted or updated.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Trivial
- Impact
- Denial Of Service
- Component
- Library
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Calling Decoder.Decode on a message containing deeply nested structures triggers a panic due to stack exhaustion in the Go runtime.
Why it matters to the business
Applications using the affected library can be crashed remotely, leading to denial of service, unplanned downtime, and operational disruption until the process is restarted.
How an attack unfolds
An attacker crafts a serialized message with excessive nesting depth and sends it to any component that calls Decoder.Decode on untrusted input, causing the decoder to exhaust the call stack and panic the process.
How to fix it
Upgrade github.com/regclient/regclient to version 0.7.1 or later. Validate that all dependent applications rebuild against the patched module and restart services after deployment.
How to confirm the fix worked
Confirm the installed module version meets or exceeds 0.7.1, then test decode operations with known deeply nested inputs to ensure no panic occurs.
Typical attack path
- Identify an endpoint or API that accepts serialized data processed by Decoder.Decode
- Craft a malicious payload containing deeply nested structures
- Transmit the payload over the network to the target
- Trigger the decode operation resulting in immediate process panic and crash
How to detect it
Search application and system logs for Go runtime panic messages indicating stack exhaustion during decode operations; correlate with inbound network traffic containing serialized data.
- runtime: stack overflow
- fatal error: stack overflow
- panic: runtime error: stack overflow
What your security team should do
- Immediately upgrade all instances of github.com/regclient/regclient to 0.7.1
- Review and restrict untrusted input sources feeding into Decoder.Decode calls
- Add runtime monitoring for Go process crashes and stack-related panics
- Test upgrade in staging before production rollout
The record
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | stdlib | 0 | 1.22.7 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | buildah | 0 | 2:1.33.8-4.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | buildah | 0 | 2:1.33.8-4.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | buildah-tests | 0 | 2:1.33.8-4.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | buildah-tests | 0 | 2:1.33.8-4.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | cockpit-podman | 0 | 84.1-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | container-selinux | 0 | 2:2.229.0-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | delve | 0 | 1.21.2-4.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | git-lfs | 0 | 3.4.1-3.el8_10 |
| AlmaLinux:8 | go-toolset | 0 | 1.21.13-1.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | golang | 0 | 1.21.13-2.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | golang-bin | 0 | 1.21.13-2.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | golang-docs | 0 | 1.21.13-2.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | golang-misc | 0 | 1.21.13-2.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | golang-src | 0 | 1.21.13-2.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | golang-tests | 0 | 1.21.13-2.module_el8.10.0+3895+92d465e0 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | osbuild-composer | 0 | 101-2.el8_10.alma.1 |
| AlmaLinux:8 | osbuild-composer-core | 0 | 101-2.el8_10.alma.1 |
| AlmaLinux:8 | osbuild-composer-worker | 0 | 101-2.el8_10.alma.1 |
| AlmaLinux:8 | podman | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | podman-catatonit | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-catatonit | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | podman-docker | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | podman-gvproxy | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | podman-plugins | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-plugins | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | podman-remote | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-remote | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | podman-tests | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-tests | 0 | 4:4.9.4-13.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | python3-podman | 0 | 4.9.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | runc | 0 | 1:1.1.12-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-3.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-3.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | udica | 0 | 0.2.6-21.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:9 | buildah | 0 | 2:1.33.9-1.el9_4 |
| AlmaLinux:9 | buildah | 0 | 2:1.37.5-1.el9_5 |
| AlmaLinux:9 | buildah-tests | 0 | 2:1.33.9-1.el9_4 |
| AlmaLinux:9 | buildah-tests | 0 | 2:1.37.5-1.el9_5 |
| AlmaLinux:9 | containernetworking-plugins | 0 | 1:1.4.0-6.el9_4 |
| AlmaLinux:9 | containernetworking-plugins | 0 | 1:1.5.1-3.el9_5 |
| AlmaLinux:9 | delve | 0 | 1.24.1-2.el9_5 |
| AlmaLinux:9 | git-lfs | 0 | 3.4.1-4.el9_4 |
| AlmaLinux:9 | go-toolset | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | go-toolset | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | golang | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang-bin | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | golang-bin | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang-docs | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | golang-docs | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang-misc | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | golang-misc | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang-race | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang-src | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | golang-src | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | golang-tests | 0 | 1.21.13-3.el9_4 |
| AlmaLinux:9 | golang-tests | 0 | 1.23.6-2.el9_5 |
| AlmaLinux:9 | grafana | 0 | 9.2.10-17.el9_4 |
| AlmaLinux:9 | grafana | 0 | 10.2.6-7.el9_5 |
| AlmaLinux:9 | grafana-pcp | 0 | 5.1.1-3.el9_4 |
| AlmaLinux:9 | grafana-pcp | 0 | 5.1.1-9.el9_5 |
| AlmaLinux:9 | grafana-selinux | 0 | 9.2.10-17.el9_4 |
| AlmaLinux:9 | grafana-selinux | 0 | 10.2.6-7.el9_5 |
| AlmaLinux:9 | osbuild-composer | 0 | 101-2.el9_4.alma.1 |
| AlmaLinux:9 | osbuild-composer | 0 | 118-2.el9_5.alma.1 |
| AlmaLinux:9 | osbuild-composer-core | 0 | 101-2.el9_4.alma.1 |
| AlmaLinux:9 | osbuild-composer-core | 0 | 118-2.el9_5.alma.1 |
| AlmaLinux:9 | osbuild-composer-worker | 0 | 101-2.el9_4.alma.1 |
| AlmaLinux:9 | osbuild-composer-worker | 0 | 118-2.el9_5.alma.1 |
| AlmaLinux:9 | podman | 0 | 4:4.9.4-13.el9_4 |
| AlmaLinux:9 | podman | 0 | 4:5.2.2-9.el9_5 |
| AlmaLinux:9 | podman-docker | 0 | 4:4.9.4-13.el9_4 |
| AlmaLinux:9 | podman-docker | 0 | 4:5.2.2-9.el9_5 |
| AlmaLinux:9 | podman-plugins | 0 | 4:4.9.4-13.el9_4 |
| AlmaLinux:9 | podman-plugins | 0 | 4:5.2.2-9.el9_5 |
| AlmaLinux:9 | podman-remote | 0 | 4:4.9.4-13.el9_4 |
| AlmaLinux:9 | podman-remote | 0 | 4:5.2.2-9.el9_5 |
| AlmaLinux:9 | podman-tests | 0 | 4:4.9.4-13.el9_4 |
| AlmaLinux:9 | podman-tests | 0 | 4:5.2.2-9.el9_5 |
| AlmaLinux:9 | skopeo | 0 | 2:1.14.5-2.el9_4 |
| AlmaLinux:9 | skopeo | 0 | 2:1.16.1-2.el9_5 |
| AlmaLinux:9 | skopeo-tests | 0 | 2:1.14.5-2.el9_4 |
| AlmaLinux:9 | skopeo-tests | 0 | 2:1.16.1-2.el9_5 |
| Bitnami | golang | 0 | 1.22.7 |
| Chainguard | aactl | 0 | 0.4.12-r18 |
| Chainguard | actions-runner-controller | 0 | 0.9.3-r2 |
| Chainguard | actions-runner-controller-compat | 0 | 0.9.3-r2 |
| Chainguard | actions-runner-controller-fips | 0 | 0.9.3-r2 |
| Chainguard | actions-runner-controller-fips-compat | 0 | 0.9.3-r2 |
| Chainguard | addon-resizer | 0 | 1.8.22-r2 |
| Chainguard | addon-resizer-compat | 0 | 1.8.22-r2 |
| Chainguard | addon-resizer-fips | 0 | 1.8.22-r2 |
| Chainguard | addon-resizer-fips-compat | 0 | 1.8.22-r2 |
| Chainguard | age | 0 | 1.2.0-r2 |
| Chainguard | amass | 0 | 4.2.0-r13 |
| Chainguard | apache-beam-java-11-sdk | 0 | 2.63.0-r1 |
| Chainguard | apache-beam-java-17-sdk | 0 | 2.63.0-r1 |
| Chainguard | apache-beam-java-21-sdk | 0 | 2.63.0-r1 |
| Chainguard | apache-beam-java-sdk | 0 | 2.63.0-r1 |
| Chainguard | apache-beam-python-3.11-sdk | 0 | 2.58.1-r1 |
| Chainguard | apko | 0 | 0.18.0-r0 |
| Chainguard | argo-cd-2.10 | 0 | 2.10.16-r1 |
| Chainguard | argo-cd-2.10-compat | 0 | 2.10.16-r1 |
| Chainguard | argo-cd-2.10-repo-server | 0 | 2.10.16-r1 |
| Chainguard | argo-cd-2.11 | 0 | 2.11.8-r0 |
| Chainguard | argo-cd-2.11-compat | 0 | 2.11.8-r0 |
| Chainguard | argo-cd-2.11-repo-server | 0 | 2.11.8-r0 |
| Chainguard | argo-cd-2.12 | 0 | 2.12.3-r1 |
| Chainguard | argo-cd-2.12-compat | 0 | 2.12.3-r1 |
| Chainguard | argo-cd-2.12-repo-server | 0 | 2.12.3-r1 |
| Chainguard | argo-cd-fips-2.10 | 0 | 2.10.16-r2 |
| Chainguard | argo-cd-fips-2.10-compat | 0 | 2.10.16-r2 |
| Chainguard | argo-cd-fips-2.10-repo-server | 0 | 2.10.16-r2 |
| Chainguard | argo-cd-fips-2.11 | 0 | 2.11.8-r0 |
| Chainguard | argo-cd-fips-2.11-compat | 0 | 2.11.8-r0 |
| Chainguard | argo-cd-fips-2.11-repo-server | 0 | 2.11.8-r0 |
| Chainguard | argo-cd-fips-2.12 | 0 | 2.12.3-r1 |
| Chainguard | argo-cd-fips-2.12-compat | 0 | 2.12.3-r1 |
| Chainguard | argo-cd-fips-2.12-repo-server | 0 | 2.12.3-r1 |
| Chainguard | argo-workflow-cli | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-cli-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-controller | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-compat | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-compat-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-executor | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-compat | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-compat-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflows | 0 | 3.6.5-r2 |
| Chainguard | argo-workflows-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflows-known-hosts | 0 | 3.6.5-r2 |
| Chainguard | argo-workflows-known-hosts-fips | 0 | 3.6.5-r2 |
| Chainguard | argo-workflows-ui | 0 | 3.6.5-r2 |
| Chainguard | atlantis | 0 | 0.29.0-r1 |
| Chainguard | atlantis-fips | 0 | 0.29.0-r1 |
| Chainguard | authservice | 0 | 1.0.2-r0 |
| Chainguard | authservice-compat | 0 | 1.0.2-r0 |
| Chainguard | authservice-fips | 0 | 1.0.1-r2 |
| Chainguard | authservice-fips-compat | 0 | 1.0.1-r2 |
| Chainguard | aws-ebs-csi-driver | 0 | 1.34.0-r1 |
| Chainguard | aws-ebs-csi-driver-fips | 0 | 1.34.0-r2 |
| Chainguard | aws-efs-csi-driver | 0 | 2.0.7-r1 |
| Chainguard | aws-efs-csi-driver-fips | 0 | 2.0.7-r1 |
| Chainguard | aws-flb-cloudwatch | 0 | 1.9.4-r13 |
| Chainguard | aws-flb-cloudwatch-compat | 0 | 1.9.4-r13 |
| Chainguard | aws-flb-cloudwatch-compat-fips | 0 | 1.9.4-r6 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r6 |
Related vulnerabilities
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects stdlib
- CVE-2025-22873 It was possible to improperly access the parent directory of an os.Root by opening a… Also affects stdlib
- GO-2026-4403 Improper access to parent directory of root in os Also affects stdlib
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects stdlib
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects stdlib
- CVE-2025-61730 During the TLS 1.3 handshake if multiple messages are sent in records that span… Also affects stdlib
- CVE-2025-61727 An excluded subdomain constraint in a certificate chain does not restrict the usage of… Also affects stdlib
- CVE-2025-61729 Within HostnameError.Error(), when constructing an error string, there is no limit to the… Also affects stdlib