You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
The encoding/gob package in Go versions prior to 1.22.7 contains a vulnerability (GO-2024-3106) that can cause a panic due to stack exhaustion when Decoder.Decode processes messages with deeply nested structures. This issue is identified as CVE-2024-34156.
To Reproduce
Use Decoder.Decode to process a message with deeply nested structures, leading to a stack overflow and application crash.
Expected behavior
The application should handle nested structures gracefully without causing a stack overflow or panic.
Screenshots
N/A
Desktop (please complete the following information):
Go version: 1.22.5
OS: [Your Operating System]
Architecture: [Your System Architecture]
Additional context
Upgrading to Go version 1.22.7 or later addresses this vulnerability. It's recommended to update the go.mod file to require Go 1.22.7 and ensure all dependencies are compatible with this version. For more details, refer to the official Go vulnerability report: GO-2024-3106.
The text was updated successfully, but these errors were encountered:
Describe the bug
The
encoding/gob
package in Go versions prior to 1.22.7 contains a vulnerability (GO-2024-3106) that can cause a panic due to stack exhaustion whenDecoder.Decode
processes messages with deeply nested structures. This issue is identified as CVE-2024-34156.To Reproduce
Use
Decoder.Decode
to process a message with deeply nested structures, leading to a stack overflow and application crash.Expected behavior
The application should handle nested structures gracefully without causing a stack overflow or panic.
Screenshots
N/A
Desktop (please complete the following information):
Additional context
Upgrading to Go version 1.22.7 or later addresses this vulnerability. It's recommended to update the
go.mod
file to require Go 1.22.7 and ensure all dependencies are compatible with this version. For more details, refer to the official Go vulnerability report: GO-2024-3106.The text was updated successfully, but these errors were encountered: