CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint
Summary
CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint. Affects stdlib across 2 version ranges.
< 1.22.7
>= 1.23.0-0, < 1.23.1
Fixed in 1.22.7 or 1.23.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2024-34158 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The go/build/constraint package is part of the Go standard library and provides functionality for parsing build constraints in Go source files. Build constraints are special comments that control which source files are included in the build based on the target platform or other conditions. The Parse function in go/build/constraint is responsible for parsing these build constraints. However, a vulnerability exists in the Parse function that can lead to stack exhaustion when processing deeply nested expressions in build tag lines.
Vulnerability Detail
The vulnerability arises when the Parse function is called with a "// +build" build tag line that contains deeply nested expressions. This can cause a panic due to stack exhaustion, potentially leading to a denial of service (DoS) condition. An attacker could exploit this vulnerability by crafting a malicious Go source file with a specially crafted build tag line, causing the application to panic and crash. The impact of this vulnerability depends on the context in which the vulnerable code is used, but it has the potential to disrupt the availability of affected applications.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.22.71.22.7go get stdlib@v1.22.7 -
>= 1.23.0-0, < 1.23.11.23.1go get stdlib@v1.23.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Developers are advised to update their Go installations to the fixed versions.
Conclusion
The go/build/constraint package in the Go standard library is vulnerable to a stack exhaustion issue in the Parse function. This vulnerability can be exploited by providing a malicious Go source file with a specially crafted build tag line. To mitigate this vulnerability, developers should update their Go installations to version 1.23.1 or later. It is important to stay up to date with the latest stable version of Go to ensure the security and stability of applications.
See every vulnerability recorded for stdlib →
FAQ
The go/build/constraint package is part of the Go standard library and provides functionality for parsing build constraints in Go source files. Build constraints are special comments that control which source files are included in the build based on the target platform or other conditions.
The Parse function in go/build/constraint is responsible for parsing build constraints in Go source files. It processes the build tag lines and extracts the relevant information to determine which source files should be included in the build.
The vulnerability occurs when the Parse function is called with a "// +build" build tag line that contains deeply nested expressions. This can cause a panic due to stack exhaustion, potentially leading to a denial of service (DoS) condition.
The impact of this vulnerability depends on the context in which the vulnerable code is used. In general, it can lead to a denial of service (DoS) condition, causing the affected application to crash and become unavailable.
Developers should update their Go installations to version 1.23.1 or later. The fix for this vulnerability was introduced in Go version 1.22.7 and further improved in version 1.23.0-0. It is recommended to always use the latest stable version of Go to ensure the latest security patches and bug fixes are applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
