VDB
RHSA-2025%3A23176
RHSA-2025%3A23176
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:1d15d8b7f90327a4216efba353d61c94a9438e5a8df3e68da44907816943d0d3_ppc64le as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-rhel8@sha256:1d15d8b7f90327a4216efba353d61c94a9438e5a8df3e68da44907816943d0d3_ppc64le, *, registry.redhat.io/quay/quay-rhel8@sha256:1d15d8b7f90327a4216efba353d61c94a9438e5a8df3e68da44907816943d0d3_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:a152946ac895db8778f8db536f644a8a8b54f5db329918a8a9442e7aa729dc8c_ppc64le as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-operator-rhel8@sha256:a152946ac895db8778f8db536f644a8a8b54f5db329918a8a9442e7aa729dc8c_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:71895379c0dca4fca449a1aee75d8aad06e1e72be3dee726cbe4c4f8fbe84fe2_arm64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-operator-rhel8@sha256:71895379c0dca4fca449a1aee75d8aad06e1e72be3dee726cbe4c4f8fbe84fe2_arm64 |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:1d15d8b7f90327a4216efba353d61c94a9438e5a8df3e68da44907816943d0d3_ppc64le as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-rhel8@sha256:1d15d8b7f90327a4216efba353d61c94a9438e5a8df3e68da44907816943d0d3_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:92f9ae720c5c444a3e81ca42987152a689d2eaaa661e28b4cbc0363f1eaf56ce_s390x as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:92f9ae720c5c444a3e81ca42987152a689d2eaaa661e28b4cbc0363f1eaf56ce_s390x |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b416224b4baa5a3c8663454f355aee800e327b28c6f19e0618b64b55f8daaf37_arm64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b416224b4baa5a3c8663454f355aee800e327b28c6f19e0618b64b55f8daaf37_arm64 |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:c0a8c5f5454426844c43f8732ed512ab30b5d4bd3e799fa3f133670d0ea431d5_amd64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:c0a8c5f5454426844c43f8732ed512ab30b5d4bd3e799fa3f133670d0ea431d5_amd64, *, * |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:625daa899431d9a6526e65c8834435cd4b065cc9ad36406023f1ba3820032e9a_s390x as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/clair-rhel8@sha256:625daa899431d9a6526e65c8834435cd4b065cc9ad36406023f1ba3820032e9a_s390x, registry.redhat.io/quay/clair-rhel8@sha256:625daa899431d9a6526e65c8834435cd4b065cc9ad36406023f1ba3820032e9a_s390x, registry.redhat.io/quay/clair-rhel8@sha256:625daa899431d9a6526e65c8834435cd4b065cc9ad36406023f1ba3820032e9a_s390x |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f635f510c78e52dedc4cbd4b721cc98446a58a03d6f245713e3aaf6ba6f6dd57_amd64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f635f510c78e52dedc4cbd4b721cc98446a58a03d6f245713e3aaf6ba6f6dd57_amd64, *, * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:9598f801ee479cb633d512b63a95659e05dbbd8d867e383dca5867f09e97e145_amd64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-operator-rhel8@sha256:9598f801ee479cb633d512b63a95659e05dbbd8d867e383dca5867f09e97e145_amd64, *, registry.redhat.io/quay/quay-operator-rhel8@sha256:9598f801ee479cb633d512b63a95659e05dbbd8d867e383dca5867f09e97e145_amd64 |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:0b00334468578780a4e4b34c03260e57aa07ec47b0d4860b17c8ec964eb7634d_arm64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-rhel8@sha256:0b00334468578780a4e4b34c03260e57aa07ec47b0d4860b17c8ec964eb7634d_arm64 |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:625daa899431d9a6526e65c8834435cd4b065cc9ad36406023f1ba3820032e9a_s390x as a component of Red Hat Quay 3.13 | * |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:28b200a0ba2c8095d93fc95edbdcdf83b2507a7379f2842fc0a1b7cc5fdd839c_s390x as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-rhel8@sha256:28b200a0ba2c8095d93fc95edbdcdf83b2507a7379f2842fc0a1b7cc5fdd839c_s390x |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fdee61c8dad676392456956ee47d5404f4b7bbf341453322d14feb71eb7660ab_ppc64le as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:fdee61c8dad676392456956ee47d5404f4b7bbf341453322d14feb71eb7660ab_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9dd0249bc2ed6b1c2b26de52217d491204c925df3012df3ee3aeaaaa52b831b0_amd64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9dd0249bc2ed6b1c2b26de52217d491204c925df3012df3ee3aeaaaa52b831b0_amd64, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9dd0249bc2ed6b1c2b26de52217d491204c925df3012df3ee3aeaaaa52b831b0_amd64, registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9dd0249bc2ed6b1c2b26de52217d491204c925df3012df3ee3aeaaaa52b831b0_amd64 |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:0bb986d4f52cef09dd9a104660426a69d1f2c252b2f604758ae39a7cbaf7ee9b_amd64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-builder-rhel8@sha256:0bb986d4f52cef09dd9a104660426a69d1f2c252b2f604758ae39a7cbaf7ee9b_amd64 |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:1badbeb73cfe6c33bbff6922f778fe967bccbaaff72898a391d02880e765aad7_ppc64le as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/clair-rhel8@sha256:1badbeb73cfe6c33bbff6922f778fe967bccbaaff72898a391d02880e765aad7_ppc64le |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:6b8ae3a48b6237c6c689f1e62b3bb4eea645b5a3797a4e09e4a308f84f0c9ee7_arm64 as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-builder-rhel8@sha256:6b8ae3a48b6237c6c689f1e62b3bb4eea645b5a3797a4e09e4a308f84f0c9ee7_arm64, registry.redhat.io/quay/quay-builder-rhel8@sha256:6b8ae3a48b6237c6c689f1e62b3bb4eea645b5a3797a4e09e4a308f84f0c9ee7_arm64, * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:92f9ae720c5c444a3e81ca42987152a689d2eaaa661e28b4cbc0363f1eaf56ce_s390x as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:92f9ae720c5c444a3e81ca42987152a689d2eaaa661e28b4cbc0363f1eaf56ce_s390x, registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:92f9ae720c5c444a3e81ca42987152a689d2eaaa661e28b4cbc0363f1eaf56ce_s390x, * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:45b58ff658a6736e113db8b69f1e762bf8ead59110903f5a2adc16ebf6cb532e_s390x as a component of Red Hat Quay 3.13 | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:45b58ff658a6736e113db8b69f1e762bf8ead59110903f5a2adc16ebf6cb532e_s390x |
…and 42 more
Timeline
- Dec 15, 2025 CVE Published
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:23176 advisory
- https://access.redhat.com/security/cve/CVE-2024-34156 advisory
- https://access.redhat.com/security/cve/CVE-2025-47913 advisory
- https://access.redhat.com/security/cve/CVE-2025-59420 advisory
- https://access.redhat.com/security/cve/CVE-2025-61920 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23176.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2310528 issue
- https://www.cve.org/CVERecord?id=CVE-2024-34156 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-34156 advisory
- https://go.dev/cl/611239 advisory
- https://go.dev/issue/69139 advisory
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk advisory
- https://pkg.go.dev/vuln/GO-2024-3106 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2414943 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47913 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47913 advisory
- https://github.com/advisories/GHSA-hcg3-q754-cr77 advisory
- https://go.dev/cl/700295 advisory
- https://go.dev/issue/75178 advisory
…and 11 more