VDB
CVE-2024-34155
CVE-2024-34155
PUBLISHED
CVSS 4.3 MEDIUM
Stack exhaustion in all Parse functions in go/parser
Reported by go · Published September 6, 2024
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| chartmuseum | Wolfi | 0.16.2-r6 |
| crossplane-provider-aws-rds | Chainguard | 1.13.0-r1 |
| contour-1.29 | Wolfi | 1.29.2-r3 |
| newrelic-fluent-bit-output | Chainguard | 2.4.0-r5 |
| libnvidia-container | Wolfi | 1.16.1-r1 |
| rabbitmq-messaging-topology-operator | Chainguard | 1.14.2-r3 |
| policy-controller | Wolfi | 0.9.0-r9 |
| kwok | Chainguard | 0.6.0-r2 |
| logstash-exporter | Wolfi | 1.7.0-r1 |
| kubernetes-dns-node-cache | Wolfi | 1.23.1-r4 |
| petname | Chainguard | 2.11-r10 |
| traefik-fips-3.1 | Chainguard | 3.1.3-r0 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | go/parser | 0, 1.23.0-0 |
| wolfi | chartmuseum | 0 |
| chainguard | crossplane-provider-aws-rds | 0 |
| wolfi | contour-1.29 | 0 |
| chainguard | newrelic-fluent-bit-output | 0 |
| wolfi | libnvidia-container | 0 |
| chainguard | rabbitmq-messaging-topology-operator | 0 |
| wolfi | policy-controller | 0 |
| chainguard | kwok | 0 |
| wolfi | logstash-exporter | 0 |
| wolfi | kubernetes-dns-node-cache | 0 |
| chainguard | petname | 0 |
| chainguard | traefik-fips-3.1 | 0 |
| wolfi | age | 0 |
| wolfi | falcosidekick | 0 |
| chainguard | nri-prometheus | 0 |
| chainguard | helm-operator-fips-1.33 | 0 |
| chainguard | kuberay-operator | 0 |
| wolfi | contour-1.28 | 0 |
| wolfi | tekton-pipelines | 0 |
…and 1404 more
Timeline
- Sep 5, 2024 CVE Published
- Sep 7, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (19 in total, the first dated here)
- May 5, 2026 CVE Updated
- Jun 2, 2026 Security Advisory (123 in total, the first dated here)
- Nov 1, 2026 Distribution Patch (115 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-34155
vulnetix vdb fixes CVE-2024-34155Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-34155/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart