CVE-2024-37298: Memory Exhaustion Attack in github.com/gorilla/schema
Summary
CVE-2024-37298: Potential memory exhaustion attack due to sparse slice deserialization. Affects github.com/gorilla/schema versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Also tracked for
- golang-github-gorilla-schema · Debian:12
The same CVE-2024-37298 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/gorilla/schema is a Go package that provides a decoder for mapping HTTP form values to Go structs. It is commonly used in web applications to handle form data. The package allows developers to define structs with arrays of other structs, which can be vulnerable to a memory exhaustion attack due to sparse slice deserialization.
Vulnerability Detail
The vulnerability arises when the schema.Decoder.Decode() function is used on a struct that contains a field of type []struct{...}. This opens up the possibility of a malicious attack that exploits the sparse slice functionality. By specifying a field value for a very large index, such as the billionth element, the decoder will allocate memory for all the elements before it in the slice. An attacker can abuse this behavior to exhaust system memory and potentially cause a denial-of-service (DoS) condition. The Proof of Concept provided demonstrates how an endpoint can be called with a specific parameter to freeze the system due to excessive memory allocation.
How To Fix
Latest published version: v1.4.1 as of 23 Oct 2026
go get github.com/gorilla/schema@v1.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
go get github.com/gorilla/schema@v1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
Conclusion
The memory exhaustion attack vulnerability in github.com/gorilla/schema can be mitigated by updating to version 1.4.1 or later. This ensures that the vulnerable code is replaced with a secure implementation. It is important for developers to promptly address this vulnerability to prevent potential denial-of-service (DoS) attacks.
See every vulnerability recorded for github.com/gorilla/schema →
FAQ
github.com/gorilla/schema is a Go package that provides a decoder for mapping HTTP form values to Go structs. It is commonly used in web applications for handling form data.
The vulnerability allows an attacker to perform a memory exhaustion attack, potentially leading to a denial-of-service (DoS) condition. By exploiting the sparse slice deserialization, an attacker can allocate excessive memory and freeze the system.
To fix this vulnerability, update the github.com/gorilla/schema package to version 1.4.1 or later. This version includes a fix for the memory exhaustion attack.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of the package.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
