RHSA-2025%3A22287

RHSA-2025%3A22287 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

…and 43 more

Timeline

Nov 27, 2025 CVE Published
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Jul 5, 2026 CVE Updated

References

https://access.redhat.com/errata/RHSA-2025:22287 advisory
https://access.redhat.com/security/cve/CVE-2024-34156 advisory
https://access.redhat.com/security/cve/CVE-2024-45337 advisory
https://access.redhat.com/security/cve/CVE-2024-45338 advisory
https://access.redhat.com/security/cve/CVE-2025-59420 advisory
https://access.redhat.com/security/cve/CVE-2025-61920 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22287.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2310528 issue
https://www.cve.org/CVERecord?id=CVE-2024-34156 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34156 advisory
https://go.dev/cl/611239 advisory
https://go.dev/issue/69139 advisory
https://groups.google.com/g/golang-dev/c/S9POB9NCTdk advisory
https://pkg.go.dev/vuln/GO-2024-3106 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
https://go.dev/cl/635315 advisory

…and 20 more

Open in Interactive Console →

Vendor	Product	Versions
Red Hat	registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:878b011b86512d01021feb10cdd54608a3ab68d2f3db5a1d53ce8feaa9e56878_amd64 as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:76dd5f7b326afb6c72515daed8e65331f98cb7ad514612c06c85f14de6b525e4_arm64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-builder-rhel8@sha256:76dd5f7b326afb6c72515daed8e65331f98cb7ad514612c06c85f14de6b525e4_arm64
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:02ced94ebfcce3e21bcc71af6aa1c11db50822c91dd05cec4fb41a34e6669112_amd64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/clair-rhel8@sha256:02ced94ebfcce3e21bcc71af6aa1c11db50822c91dd05cec4fb41a34e6669112_amd64
Red Hat	registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:878b011b86512d01021feb10cdd54608a3ab68d2f3db5a1d53ce8feaa9e56878_amd64 as a component of Red Hat Quay 3.9	, registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:878b011b86512d01021feb10cdd54608a3ab68d2f3db5a1d53ce8feaa9e56878_amd64,
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:97dd28bc0b588ffc8fd9a171a946580c0572eb6fb34c85d5e1b799a12cf22574_arm64 as a component of Red Hat Quay 3.9	, , registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:97dd28bc0b588ffc8fd9a171a946580c0572eb6fb34c85d5e1b799a12cf22574_arm64
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:02ced94ebfcce3e21bcc71af6aa1c11db50822c91dd05cec4fb41a34e6669112_amd64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/clair-rhel8@sha256:02ced94ebfcce3e21bcc71af6aa1c11db50822c91dd05cec4fb41a34e6669112_amd64, ,
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:60638663af472a24a79cc4a6ec7d4d78a3d10b0e09eec80f6da6855277ff139b_arm64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:60638663af472a24a79cc4a6ec7d4d78a3d10b0e09eec80f6da6855277ff139b_arm64
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:a6e6c1f865e6c3e237c36bbb58b3c0e533171303e21cbe4d829d05b497fcd5c7_arm64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-operator-rhel8@sha256:a6e6c1f865e6c3e237c36bbb58b3c0e533171303e21cbe4d829d05b497fcd5c7_arm64
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c622550fb4630be48a1a6e1a8f9337718e4f934b5e5cd23bcc4300beb03eeeae_s390x as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c622550fb4630be48a1a6e1a8f9337718e4f934b5e5cd23bcc4300beb03eeeae_s390x
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:7cfa21df6e22c2157d2eb65b5e226863a121c8e661a1869b585ca0656fb6013a_s390x as a component of Red Hat Quay 3.9	, , *
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:26a27da8aa0da9a6673907fe35de61cc93932386070dc3d7ad348e8c086b19d7_ppc64le as a component of Red Hat Quay 3.9	, registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:26a27da8aa0da9a6673907fe35de61cc93932386070dc3d7ad348e8c086b19d7_ppc64le,
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:71a6e23a69d7c4723a2653f630c8b02057545c1be65e5f4401490f0364f0d43c_ppc64le as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-operator-rhel8@sha256:71a6e23a69d7c4723a2653f630c8b02057545c1be65e5f4401490f0364f0d43c_ppc64le
Red Hat	registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:49db4fa7375da6397c45b6c09e10e20f5855348e21812d64474c3adec7f1cbdd_amd64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:49db4fa7375da6397c45b6c09e10e20f5855348e21812d64474c3adec7f1cbdd_amd64, ,
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:278facca3eaf0c2091ad8575e85ac03aef6e8a52227511e7ee5f62bc2842dac8_s390x as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-operator-rhel8@sha256:278facca3eaf0c2091ad8575e85ac03aef6e8a52227511e7ee5f62bc2842dac8_s390x
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8458e32483b897e156a5688ec6d96af2ff897e8c14dafb396c945f7c76b4c368_arm64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8458e32483b897e156a5688ec6d96af2ff897e8c14dafb396c945f7c76b4c368_arm64, ,
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:880c746eb5822f68e41ca7b60d97799115c30f39bdc7e458f7a4101e2af36c8c_s390x as a component of Red Hat Quay 3.9	registry.redhat.io/quay/clair-rhel8@sha256:880c746eb5822f68e41ca7b60d97799115c30f39bdc7e458f7a4101e2af36c8c_s390x
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:ad995b723102f4472e4190257b61582de5c6b058b908bcee7cebe683ae77be75_arm64 as a component of Red Hat Quay 3.9	registry.redhat.io/quay/clair-rhel8@sha256:ad995b723102f4472e4190257b61582de5c6b058b908bcee7cebe683ae77be75_arm64
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:26a27da8aa0da9a6673907fe35de61cc93932386070dc3d7ad348e8c086b19d7_ppc64le as a component of Red Hat Quay 3.9	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:42a67bb2e5ab681eadc253b413f0bf557d63f282f270e6064f5768fecf6886e5_ppc64le as a component of Red Hat Quay 3.9	, , *
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:decf4b7e1917a2c551ea095c9798a65237879369e9f736a44b885e2589e5c05b_ppc64le as a component of Red Hat Quay 3.9	, registry.redhat.io/quay/quay-builder-rhel8@sha256:decf4b7e1917a2c551ea095c9798a65237879369e9f736a44b885e2589e5c05b_ppc64le,