GO-2024-3105
Stack exhaustion in all Parse functions in go/parser
At a glance
- Published
- Updated
- CVE
- CVE-2024-34155
- Aliases
- BIT-golang-2024-34155
Description
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.22.7, introduced 1.23.0-0, fixed 1.23.1 |
References
- https://go.dev/cl/611238 FIX
- https://go.dev/issue/69138 REPORT
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |