VDB
RHSA-2025%3A23061
RHSA-2025%3A23061
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:795bd464d6825f905679d1ad504d7e4f5c6291f89706f3b78c41bc6776522805_arm64 as a component of Red Hat Quay 3.9 | *, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:795bd464d6825f905679d1ad504d7e4f5c6291f89706f3b78c41bc6776522805_arm64, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:795bd464d6825f905679d1ad504d7e4f5c6291f89706f3b78c41bc6776522805_arm64 |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:5f883757f060b68dfd010f125d31556df3d29c129de088c257debd8239cf7d40_amd64 as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-builder-rhel8@sha256:5f883757f060b68dfd010f125d31556df3d29c129de088c257debd8239cf7d40_amd64, registry.redhat.io/quay/quay-builder-rhel8@sha256:5f883757f060b68dfd010f125d31556df3d29c129de088c257debd8239cf7d40_amd64, * |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:880c746eb5822f68e41ca7b60d97799115c30f39bdc7e458f7a4101e2af36c8c_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/clair-rhel8@sha256:880c746eb5822f68e41ca7b60d97799115c30f39bdc7e458f7a4101e2af36c8c_s390x, registry.redhat.io/quay/clair-rhel8@sha256:880c746eb5822f68e41ca7b60d97799115c30f39bdc7e458f7a4101e2af36c8c_s390x, * |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:55a8de289089989f26365c0011d30310fdc525e8515f7be94956b8c21769edda_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-rhel8@sha256:55a8de289089989f26365c0011d30310fdc525e8515f7be94956b8c21769edda_s390x, registry.redhat.io/quay/quay-rhel8@sha256:55a8de289089989f26365c0011d30310fdc525e8515f7be94956b8c21769edda_s390x |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:47e21d3d9c9ee2de4a1e557e32521f64db2098b9f4dcd32e0d6f4d0962be7993_amd64 as a component of Red Hat Quay 3.9 | *, registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:47e21d3d9c9ee2de4a1e557e32521f64db2098b9f4dcd32e0d6f4d0962be7993_amd64 |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:42a67bb2e5ab681eadc253b413f0bf557d63f282f270e6064f5768fecf6886e5_ppc64le as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/clair-rhel8@sha256:42a67bb2e5ab681eadc253b413f0bf557d63f282f270e6064f5768fecf6886e5_ppc64le, *, * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:118676c250f94b51d2484414190933c1d8fa61605cef0deff2aab6527f783d73_ppc64le as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-builder-rhel8@sha256:118676c250f94b51d2484414190933c1d8fa61605cef0deff2aab6527f783d73_ppc64le, registry.redhat.io/quay/quay-builder-rhel8@sha256:118676c250f94b51d2484414190933c1d8fa61605cef0deff2aab6527f783d73_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ddbf02cbfae810853f79628b576abcd0276f27ef27ad07a92f71df93a339cb4a_ppc64le as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ddbf02cbfae810853f79628b576abcd0276f27ef27ad07a92f71df93a339cb4a_ppc64le, registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ddbf02cbfae810853f79628b576abcd0276f27ef27ad07a92f71df93a339cb4a_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:7db467404171294d793ef0fd1a59fd6e5bd20ed8915913a1edf013d18e4c9a78_amd64 as a component of Red Hat Quay 3.9 | *, * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b3fc7bb5b6912f68e9b3422eb2f3ad072f0cd8ff412c5b56b9879fd4a6f3f78c_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b3fc7bb5b6912f68e9b3422eb2f3ad072f0cd8ff412c5b56b9879fd4a6f3f78c_s390x, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b3fc7bb5b6912f68e9b3422eb2f3ad072f0cd8ff412c5b56b9879fd4a6f3f78c_s390x, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b3fc7bb5b6912f68e9b3422eb2f3ad072f0cd8ff412c5b56b9879fd4a6f3f78c_s390x |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:e701896ef9c36202581832d3dd9413f99c94ab7da435f7afb91c9e0ffe2e20ae_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:e701896ef9c36202581832d3dd9413f99c94ab7da435f7afb91c9e0ffe2e20ae_s390x, registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:e701896ef9c36202581832d3dd9413f99c94ab7da435f7afb91c9e0ffe2e20ae_s390x |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:6d831031c1e4cdc251236b241e4a15b7152900d75fb0bee8bdd39610e249a53b_ppc64le as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-operator-rhel8@sha256:6d831031c1e4cdc251236b241e4a15b7152900d75fb0bee8bdd39610e249a53b_ppc64le, * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1deefc2cd91d0f2c474eda0fbb81bbce30786754d8fb9100b73823fae9562a40_amd64 as a component of Red Hat Quay 3.9 | *, registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1deefc2cd91d0f2c474eda0fbb81bbce30786754d8fb9100b73823fae9562a40_amd64, registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:1deefc2cd91d0f2c474eda0fbb81bbce30786754d8fb9100b73823fae9562a40_amd64 |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:7db467404171294d793ef0fd1a59fd6e5bd20ed8915913a1edf013d18e4c9a78_amd64 as a component of Red Hat Quay 3.9 | *, registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:7db467404171294d793ef0fd1a59fd6e5bd20ed8915913a1edf013d18e4c9a78_amd64, * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:c644998824e04ecf279deae25a22cce6c48d8bca44755f76eb4abacf17052519_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-builder-rhel8@sha256:c644998824e04ecf279deae25a22cce6c48d8bca44755f76eb4abacf17052519_s390x, registry.redhat.io/quay/quay-builder-rhel8@sha256:c644998824e04ecf279deae25a22cce6c48d8bca44755f76eb4abacf17052519_s390x |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:00dc04b86ae7fd7dd37e9234ed2b4a1d0f0403993c153e197ac8b96233e95048_amd64 as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:00dc04b86ae7fd7dd37e9234ed2b4a1d0f0403993c153e197ac8b96233e95048_amd64, *, * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:1230d53c9bf30d0ef730a403012530c0bf654d597b164687911524f8b5085eac_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-operator-rhel8@sha256:1230d53c9bf30d0ef730a403012530c0bf654d597b164687911524f8b5085eac_s390x, registry.redhat.io/quay/quay-operator-rhel8@sha256:1230d53c9bf30d0ef730a403012530c0bf654d597b164687911524f8b5085eac_s390x |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:cc9d5c2de42541033a2c01aeb385404058cdac60a8cd2fd9889f7d73cdbc6292_amd64 as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:cc9d5c2de42541033a2c01aeb385404058cdac60a8cd2fd9889f7d73cdbc6292_amd64, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:cc9d5c2de42541033a2c01aeb385404058cdac60a8cd2fd9889f7d73cdbc6292_amd64 |
| Red Hat | registry.redhat.io/quay/quay-operator-bundle@sha256:3c1f25918b505ec71eaf93d2a0b963d209e36d847e7fc48469f9d40b534344ae_amd64 as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-operator-bundle@sha256:3c1f25918b505ec71eaf93d2a0b963d209e36d847e7fc48469f9d40b534344ae_amd64, registry.redhat.io/quay/quay-operator-bundle@sha256:3c1f25918b505ec71eaf93d2a0b963d209e36d847e7fc48469f9d40b534344ae_amd64 |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b0b66c3c98a91dc4d4e1e0dd1b2fa58b542b02e27ba283cd5d90b7758ebfaf21_s390x as a component of Red Hat Quay 3.9 | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b0b66c3c98a91dc4d4e1e0dd1b2fa58b542b02e27ba283cd5d90b7758ebfaf21_s390x, registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b0b66c3c98a91dc4d4e1e0dd1b2fa58b542b02e27ba283cd5d90b7758ebfaf21_s390x |
…and 44 more
Timeline
- Dec 10, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 5, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:23061 advisory
- https://access.redhat.com/security/cve/CVE-2024-34156 advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://access.redhat.com/security/cve/CVE-2025-47913 advisory
- https://access.redhat.com/security/cve/CVE-2025-59420 advisory
- https://access.redhat.com/security/cve/CVE-2025-61920 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23061.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2310528 issue
- https://www.cve.org/CVERecord?id=CVE-2024-34156 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-34156 advisory
- https://go.dev/cl/611239 advisory
- https://go.dev/issue/69139 advisory
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk advisory
- https://pkg.go.dev/vuln/GO-2024-3106 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
…and 28 more