Stack exhaustion in all Parse functions in go/parser
Priority LOW 22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 29 fixed, 30 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00839 58th percentileScored 2026-11-07
Fix Partial go/parser (Go standard library): 1.22.7, 1.23.1Red Hat: 38 advisoriesRed Hat: 29 fixed, 30 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | go/parser | before 1.22.7; 1.23.0-0 to before 1.23.1 | 1.22.7, 1.23.1 | Patch available | CNA |
- go/parser VendorGo standard library Affected before 1.22.7; 1.23.0-0 to before 1.23.1 Fixed in 1.22.7, 1.23.1 Patch available CNA
Remediation
- Fix · CNA go/parser (Go standard library) Fixed in 1.22.7, 1.23.1
Red Hat 38 advisories
- RHSA-2026:2172 Released 2026-02-05 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.15 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
- RHSA-2026:2164 Released 2026-02-05 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
- RHSA-2025:9776 Released 2025-06-26 · Red Hat rating ImportantNew RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
Show 35 more Red Hat advisories
- RHSA-2025:0771 Released 2025-01-28 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.4.2 security and bug fix update
- 9Base-OADP-1.4 oadp/oadp-velero-rhel9
- RHSA-2024:10906 Released 2024-12-10 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8 +1
- RHSA-2024:10895 Released 2024-12-09 · Red Hat rating ModerateCost Management Metrics Operator Update
- Cost Management Metrics Operator 3.3.2 registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator
- RHSA-2024:10883 Released 2024-12-09 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (osp-director-operator) security update
- Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
- RHSA-2024:8704 Released 2024-12-02 · Red Hat rating ModerateKube Descheduler Operator for Red Hat OpenShift 5.0.2 for RHEL 9
- KDO 5.0 for RHEL 9 kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator
- RHSA-2024:10236 Released 2024-11-25 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.17.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
- RHSA-2024:9960 Released 2024-11-19 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.3.4 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-rhel9
- RHSA-2024:8219 Released 2024-11-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.2.2 for RHEL 9
- OSSO 1.2 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
- RHSA-2024:9485 Released 2024-11-13 · Red Hat rating ImportantControl plane Operators for RHOSO 18.0.3 (Feature Release 1) security update
- 9Base-RHOSO-1.0-PODIFIED rhoso-operators/barbican-rhel9-operator, rhoso-operators/cinder-rhel9-operator, rhoso-operators/designate-rhel9-operator +22
- RHSA-2024:9454 Released 2024-11-12 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-4:5.2.2-9.el9_5, podman-docker-4:5.2.2-9.el9_5, podman-plugins-4:5.2.2-9.el9_5 +2
- RHSA-2024:9459 Released 2024-11-12 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.37.5-1.el9_5, buildah-tests-2:1.37.5-1.el9_5
- RHSA-2024:8700 Released 2024-11-08 · Red Hat rating ImportantOpenShift Container Platform 4.14.40 packages and security update
- Red Hat OpenShift Container Platform 4.14 containernetworking-plugins-1:1.4.0-4.rhaos4.14.el8, cri-o-1.27.8-12.rhaos4.14.git7597c43.el8, cri-o-1.27.8-12.rhaos4.14.git7597c43.el9 +17
- RHSA-2024:8697 Released 2024-11-08 · Red Hat rating ImportantOpenShift Container Platform 4.14.40 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:8694 Released 2024-11-07 · Red Hat rating ImportantOpenShift Container Platform 4.12.68 security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 openstack-ironic-1:21.0.1-0.20240913135525.114badc.el9, openstack-ironic-api-1:21.0.1-0.20240913135525.114badc.el9, openstack-ironic-common-1:21.0.1-0.20240913135525.114badc.el9 +3
- Red Hat OpenShift Container Platform 4.12 containernetworking-plugins-1:1.4.0-4.rhaos4.12.el8, cri-o-1.25.5-30.rhaos4.12.git53dc492.el8, cri-o-1.25.5-5.rhaos4.12.git53dc492.el9 +18
- RHSA-2024:8692 Released 2024-11-07 · Red Hat rating ImportantOpenShift Container Platform 4.12.68 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:8690 Released 2024-11-06 · Red Hat rating ImportantOpenShift Container Platform 4.13.53 packages and security update
- Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-5.rhaos4.13.el9, buildah-tests-1:1.29.1-5.rhaos4.13.el9, conmon-3:2.1.7-5.rhaos4.13.el8 +47
- RHSA-2024:8688 Released 2024-11-06 · Red Hat rating ImportantOpenShift Container Platform 4.13.53 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:8428 Released 2024-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.15.37 packages and security update
- Red Hat OpenShift Container Platform 4.15 containernetworking-plugins-1:1.4.0-4.rhaos4.15.el8, cri-o-1.28.11-5.rhaos4.15.git35a2431.el8, cri-o-1.28.11-5.rhaos4.15.git35a2431.el9 +17
- RHSA-2024:8425 Released 2024-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.15.37 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
- RHSA-2024:8337 Released 2024-10-31 · Red Hat rating ModerateRun Once Duration Override Operator for Red Hat OpenShift 1.1.2 for RHEL 9
- RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2024:8263 Released 2024-10-24 · Red Hat rating ImportantOpenShift Container Platform 4.16.18 packages and security update
- Red Hat OpenShift Container Platform 4.16 containernetworking-plugins-1:1.4.0-5.rhaos4.16.el8, cri-o-1.29.9-5.rhaos4.16.git34690b9.el8, cri-o-1.29.9-5.rhaos4.16.git34690b9.el9 +16
- RHSA-2024:8260 Released 2024-10-24 · Red Hat rating ImportantOpenShift Container Platform 4.16.18 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:8317 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 5.8.14
- RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14
- RHSA-2024:8314 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.0.1
- RHOL 6.0 for RHEL 9 openshift-logging/logging-loki-rhel9
- RHSA-2024:8318 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 5.6.25
- RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
- RHSA-2024:8315 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 5.9.8
- RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
- RHSA-2024:8232 Released 2024-10-23 · Red Hat rating ImportantOpenShift Container Platform 4.17.2 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.17 python-zipp-3.19.1-1.el9, python3-zipp-3.19.1-1.el9
- Red Hat OpenShift Container Platform 4.17 containernetworking-plugins-1:1.4.0-4.rhaos4.17.el8, podman-4:5.2.3-2.rhaos4.17.el8, podman-4:5.2.3-2.rhaos4.17.el9 +14
- RHSA-2024:8229 Released 2024-10-23 · Red Hat rating ImportantOpenShift Container Platform 4.17.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:8329 Released 2024-10-22 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-db-rhel8, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle +6
- RHSA-2024:8014 Released 2024-10-22 · Red Hat rating ImportantNetwork Observability 1.7.0 for OpenShift
- NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:8112 Released 2024-10-15 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.9-1.el9_4, buildah-tests-2:1.33.9-1.el9_4
- RHSA-2024:8038 Released 2024-10-14 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.s390x::container-tools:rhel8 +47
- RHSA-2024:8039 Released 2024-10-14 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-13.el9_4, podman-docker-4:4.9.4-13.el9_4, podman-plugins-4:4.9.4-13.el9_4 +2
- RHSA-2024:6908 Released 2024-09-23 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64::go-toolset:rhel8, delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le::go-toolset:rhel8, delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src::go-toolset:rhel8 +19
- RHSA-2024:6913 Released 2024-09-23 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.13-3.el9_4, golang-1.21.13-3.el9_4, golang-bin-1.21.13-3.el9_4 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Builds for Red Hat OpenShift | Affected | No fix yet |
| Fence Agents Remediation Operator | Affected | No fix planned: Will not fix |
| Machine Deletion Remediation Operator | Affected | No fix planned: Will not fix |
| Migration Toolkit for Applications 7 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| Node Maintenance Operator | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Self Node Remediation Operator | Affected | No fix yet |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:10906 |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:9960 |
| 9Base-OADP-1.4 | Fixed | RHSA-2025:0771 |
| 9Base-RHOSO-1.0-PODIFIED | Fixed | RHSA-2024:9485 |
| Cost Management Metrics Operator 3.3.2 | Fixed | RHSA-2024:10895 |
| Cryostat 3 on RHEL 8 | Fixed | RHSA-2024:8329 |
| KDO 5.0 for RHEL 9 | Fixed | RHSA-2024:8704 |
| NETOBSERV 1.7 for RHEL 9 | Fixed | RHSA-2024:8014 |
| OSSO 1.2 for RHEL 9 | Fixed | RHSA-2024:8219 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2024:8318 |
| RHOL 5.8 for RHEL 9 | Fixed | RHSA-2024:8317 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:8315 |
| RHOL 6.0 for RHEL 9 | Fixed | RHSA-2024:8314 |
| RODOO 1.1 for RHEL 9 | Fixed | RHSA-2024:8337 |
| Red Hat Ceph Storage 5.3 Tools | Fixed | — |
| Red Hat Ceph Storage 7.1 Tools | Fixed | — |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:9776 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:6908, RHSA-2024:8038 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:6913, RHSA-2024:8039, RHSA-2024:8112, RHSA-2024:9454, RHSA-2024:9459 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:8692, RHSA-2024:8694 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:8688, RHSA-2024:8690 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:8697, RHSA-2024:8700 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:8425, RHSA-2024:8428 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:8260, RHSA-2024:8263 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:8229, RHSA-2024:8232 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:10236 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:10883 |
| Red Hat Openshift Data Foundation 4.15 | Fixed | RHSA-2026:2172 |
| Red Hat Openshift Data Foundation 4.16 | Fixed | RHSA-2026:2164 |
Not affected: 24 products
- 8Base-RHMTC-1.8
- 9Base-OADP-1.3
- 9Base-OADP-1.4
- Cost Management Metrics Operator 3.3.2
- Custom Metric Autoscaler operator for Red Hat Openshift
- Ironic content for Red Hat OpenShift Container Platform 4.12
- Ironic content for Red Hat OpenShift Container Platform 4.17
- KDO 5.0 for RHEL 9
- Logical Volume Manager Storage
- OSSO 1.2 for RHEL 9
- OpenShift Service Mesh 2
- RHOL 6.0 for RHEL 9
- Red Hat Enterprise Linux 10
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Dev Spaces 3
- Red Hat Openshift Data Foundation 4.15
- Red Hat Openshift Data Foundation 4.16
- Red Hat Service Interconnect 1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34155
- 2026-10-03 Alias added: GHSA-8xfx-rj4p-23jm
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Ceph Storage 5.3 Tools · Red Hat
References
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2024-34155 · CVE Program
- CVE-2024-34155 · NVD
- FIRST EPSS
- GHSA-8xfx-rj4p-23jm · GitHub Advisory Database · CC BY 4.0
- CVE-2024-34155 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences