VDB
GHSA-8xfx-rj4p-23jm
GHSA-8xfx-rj4p-23jm
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Record from GitHub Advisory Database · Published September 6, 2024
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| configmap-reload-fips | Chainguard | 0.13.1-r2 |
| crossplane-provider-aws-elasticache | Wolfi | 1.13.0-r1 |
| crossplane-provider-aws-iam | Wolfi | 1.13.0-r1 |
| protoc-gen-go-grpc | Chainguard | 1.5.1-r1 |
| telegraf-1.30 | Chainguard | 1.30.3-r8 |
| tigera-operator-1.31 | Wolfi | 1.31.2-r14 |
| skopeo | Chainguard | 1.16.1-r1 |
| yace | Chainguard | 0.61.2-r1 |
| filebeat-7.17-fips | Chainguard | 7.17.24-r0 |
| buf | Wolfi | 1.40.1-r0 |
| vault-1.16 | Chainguard | 1.16.3-r15 |
| bom | Wolfi | 0.6.0-r10 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | configmap-reload-fips | 0 |
| wolfi | crossplane-provider-aws-elasticache | 0 |
| wolfi | crossplane-provider-aws-iam | 0 |
| chainguard | protoc-gen-go-grpc | 0 |
| chainguard | telegraf-1.30 | 0 |
| wolfi | tigera-operator-1.31 | 0 |
| chainguard | skopeo | 0 |
| chainguard | yace | 0 |
| chainguard | filebeat-7.17-fips | 0 |
| wolfi | buf | 0 |
| chainguard | vault-1.16 | 0 |
| wolfi | bom | 0 |
| wolfi | cluster-autoscaler-1.28 | 0 |
| chainguard | cilium-1.16 | 0 |
| wolfi | victoriametrics-cluster | 0 |
| chainguard | authservice-fips | 0 |
| chainguard | prometheus-mongodb-exporter-fips-0.37 | 0 |
| wolfi | yam | 0 |
| wolfi | argo-cd-2.12 | 0 |
| chainguard | sbom-scorecard | 0 |
…and 1384 more
Timeline
- Sep 6, 2024 CVE Published
- Apr 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-8xfx-rj4p-23jm
vulnetix vdb fixes GHSA-8xfx-rj4p-23jmOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-8xfx-rj4p-23jm/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart