CVE-2024-34156: Stack exhaustion in encoding/gob
Summary
CVE-2024-34156: Stack exhaustion in Decoder.Decode in encoding/gob. Affects stdlib across 2 version ranges.
< 1.22.7
>= 1.23.0-0, < 1.23.1
Fixed in 1.22.7 or 1.23.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2024-34156 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The encoding/gob package in the Go standard library provides functionality for encoding and decoding Go values in a binary format. It is commonly used for serialization and deserialization of data. The package includes the Decoder.Decode function, which is responsible for decoding a binary-encoded Go value. However, a vulnerability has been discovered in this function that can lead to stack exhaustion when decoding deeply nested structures.
Vulnerability Detail
The vulnerability arises when Decoder.Decode is called on a message that contains deeply nested structures. Due to a flaw in the implementation, this can cause a panic and lead to stack exhaustion. An attacker could potentially exploit this vulnerability by crafting a malicious message that triggers the panic, resulting in a denial-of-service condition. This vulnerability is a follow-up to CVE-2022-30635, indicating that it is related to a previous vulnerability in the same package.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.22.71.22.7go get stdlib@v1.22.7 -
>= 1.23.0-0, < 1.23.11.23.1go get stdlib@v1.23.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Go installation.
Conclusion
The stack exhaustion vulnerability in the encoding/gob package can result in a denial-of-service condition when decoding deeply nested structures. It is crucial for developers to update their Go installations to version 1.23.1 or later to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can lead to a denial-of-service condition, causing the affected application to crash or become unresponsive.
Yes, an attacker can exploit this vulnerability remotely by sending a specially crafted message to the affected application.
No, versions prior to 1.22.7 are not affected by this vulnerability. However, it is still recommended to update to the latest stable release for other security fixes.
There is no known evidence of this vulnerability being actively exploited in the wild.
The only effective mitigation is to update the Go installation to a version that includes the fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
