Read the docs
TI-2024-22606 Aliases CVE-2024-34156GHSA-crqm-pwhx-j97f

Stack exhaustion in Decoder.Decode in encoding/gob

Priority MEDIUM 41Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 49 fixed, 18 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01127 66th percentileScored 2026-11-07
Fix Partial encoding/gob (Go standard library): 1.22.7, 1.23.1Red Hat: 100 advisoriesRed Hat: 49 fixed, 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard libraryencoding/gobbefore 1.22.7; 1.23.0-0 to before 1.23.11.22.7, 1.23.1Patch availableCNA
  • encoding/gob VendorGo standard library Affected before 1.22.7; 1.23.0-0 to before 1.23.1 Fixed in 1.22.7, 1.23.1 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:go_standard_library:encoding\/gob:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:go_standard_library:encoding\/gob:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA encoding/gob (Go standard library) Fixed in 1.22.7, 1.23.1

Red Hat 100 advisories

  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
Show 97 more Red Hat advisories
  • RHSA-2026:2754 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.9.18
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:2172 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.15 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:2164 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:23546 Released 2025-12-17 · Red Hat rating Important
    Red Hat Quay 3.16.0
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-container-security-operator-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2025:23176 Released 2025-12-15 · Red Hat rating Important
    Red Hat Quay 3.13.10
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-container-security-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:23064 Released 2025-12-10 · Red Hat rating Important
    Red Hat Quay 3.10.17
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:23061 Released 2025-12-10 · Red Hat rating Important
    Red Hat Quay 3.9.17
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-container-security-operator-rhel8, registry.redhat.io/quay/quay-operator-rhel8 +1
  • RHSA-2025:23060 Released 2025-12-10 · Red Hat rating Important
    Red Hat Quay 3.12
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-container-security-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:23059 Released 2025-12-10 · Red Hat rating Important
    Red Hat Quay 3.12
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-container-security-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:23028 Released 2025-12-10 · Red Hat rating Important
    Red Hat Quay 3.12
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-container-security-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:22287 Released 2025-11-27 · Red Hat rating Important
    Red Hat Quay 3.9
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:22182 Released 2025-11-26 · Red Hat rating Important
    Red Hat Quay 3.10.16
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-operator-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2025:9776 Released 2025-06-26 · Red Hat rating Important
    New RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
  • RHSA-2025:4240 Released 2025-04-28 · Red Hat rating Important
    Updated 6.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2025:3773 Released 2025-04-10 · Red Hat rating Important
    delve and golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) delve-1.24.1-2.el9_5, go-toolset-1.23.6-2.el9_5, golang-1.23.6-2.el9_5 +6
  • RHSA-2025:3501 Released 2025-04-01 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.15.1-4 Update
    • Custom Metric Autoscaler operator for Red Hat Openshift 2.15 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9
  • RHSA-2025:1190 Released 2025-02-10 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 (etcd) security update
    • Red Hat OpenStack Platform 17.1 etcd-3.4.26-9.1.el9ost
  • RHSA-2025:0771 Released 2025-01-28 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.4.2 security and bug fix update
    • 9Base-OADP-1.4 oadp/oadp-velero-rhel9
  • RHSA-2025:0203 Released 2025-01-09 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-17.el8ost
  • RHSA-2024:11217 Released 2024-12-17 · Red Hat rating Important
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.16.1-2.el9_5, skopeo-tests-2:1.16.1-2.el9_5
  • RHSA-2024:11216 Released 2024-12-17 · Red Hat rating Moderate
    containernetworking-plugins security update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.5.1-3.el9_5
  • RHSA-2024:10906 Released 2024-12-10 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
    • 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8 +1
  • RHSA-2024:10883 Released 2024-12-09 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (osp-director-operator) security update
    • Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
  • RHSA-2024:10236 Released 2024-11-25 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.17.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
  • RHSA-2024:10186 Released 2024-11-22 · Red Hat rating Important
    ACS 4.5 enhancement update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2024:9960 Released 2024-11-19 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.3.4 security and bug fix update
    • 9Base-OADP-1.3 oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-rhel9
  • RHSA-2024:9583 Released 2024-11-13 · Red Hat rating Important
    ACS 4.4 enhancement update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2024:9485 Released 2024-11-13 · Red Hat rating Important
    Control plane Operators for RHOSO 18.0.3 (Feature Release 1) security update
    • 9Base-RHOSO-1.0-PODIFIED rhoso-operators/barbican-rhel9-operator, rhoso-operators/cinder-rhel9-operator, rhoso-operators/designate-rhel9-operator +22
  • RHSA-2024:9456 Released 2024-11-12 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-118-2.el9_5, osbuild-composer-core-118-2.el9_5, osbuild-composer-worker-118-2.el9_5
  • RHSA-2024:9454 Released 2024-11-12 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:5.2.2-9.el9_5, podman-docker-4:5.2.2-9.el9_5, podman-plugins-4:5.2.2-9.el9_5 +2
  • RHSA-2024:9472 Released 2024-11-12 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-5.1.1-9.el9_5
  • RHSA-2024:9459 Released 2024-11-12 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.37.5-1.el9_5, buildah-tests-2:1.37.5-1.el9_5
  • RHSA-2024:9473 Released 2024-11-12 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-7.el9_5, grafana-selinux-10.2.6-7.el9_5
  • RHSA-2024:8700 Released 2024-11-08 · Red Hat rating Important
    OpenShift Container Platform 4.14.40 packages and security update
    • Red Hat OpenShift Container Platform 4.14 containernetworking-plugins-1:1.4.0-4.rhaos4.14.el8, cri-o-1.27.8-12.rhaos4.14.git7597c43.el8, cri-o-1.27.8-12.rhaos4.14.git7597c43.el9 +17
  • RHSA-2024:8697 Released 2024-11-08 · Red Hat rating Important
    OpenShift Container Platform 4.14.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:8694 Released 2024-11-07 · Red Hat rating Important
    OpenShift Container Platform 4.12.68 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 openstack-ironic-1:21.0.1-0.20240913135525.114badc.el9, openstack-ironic-api-1:21.0.1-0.20240913135525.114badc.el9, openstack-ironic-common-1:21.0.1-0.20240913135525.114badc.el9 +3
    • Red Hat OpenShift Container Platform 4.12 containernetworking-plugins-1:1.4.0-4.rhaos4.12.el8, cri-o-1.25.5-30.rhaos4.12.git53dc492.el8, cri-o-1.25.5-5.rhaos4.12.git53dc492.el9 +18
  • RHSA-2024:8692 Released 2024-11-07 · Red Hat rating Important
    OpenShift Container Platform 4.12.68 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:8690 Released 2024-11-06 · Red Hat rating Important
    OpenShift Container Platform 4.13.53 packages and security update
    • Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-5.rhaos4.13.el9, buildah-tests-1:1.29.1-5.rhaos4.13.el9, conmon-3:2.1.7-5.rhaos4.13.el8 +47
  • RHSA-2024:8688 Released 2024-11-06 · Red Hat rating Important
    OpenShift Container Platform 4.13.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:8428 Released 2024-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.15.37 packages and security update
    • Red Hat OpenShift Container Platform 4.15 containernetworking-plugins-1:1.4.0-4.rhaos4.15.el8, cri-o-1.28.11-5.rhaos4.15.git35a2431.el8, cri-o-1.28.11-5.rhaos4.15.git35a2431.el9 +17
  • RHSA-2024:8425 Released 2024-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.15.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2024:8263 Released 2024-10-24 · Red Hat rating Important
    OpenShift Container Platform 4.16.18 packages and security update
    • Red Hat OpenShift Container Platform 4.16 containernetworking-plugins-1:1.4.0-5.rhaos4.16.el8, cri-o-1.29.9-5.rhaos4.16.git34690b9.el8, cri-o-1.29.9-5.rhaos4.16.git34690b9.el9 +16
  • RHSA-2024:8260 Released 2024-10-24 · Red Hat rating Important
    OpenShift Container Platform 4.16.18 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:8317 Released 2024-10-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.8.14
    • RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14
  • RHSA-2024:8314 Released 2024-10-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.1
    • RHOL 6.0 for RHEL 9 openshift-logging/logging-loki-rhel9
  • RHSA-2024:8318 Released 2024-10-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.6.25
    • RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
  • RHSA-2024:8315 Released 2024-10-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.9.8
    • RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
  • RHSA-2024:8232 Released 2024-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.17.2 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.17 python-zipp-3.19.1-1.el9, python3-zipp-3.19.1-1.el9
    • Red Hat OpenShift Container Platform 4.17 containernetworking-plugins-1:1.4.0-4.rhaos4.17.el8, podman-4:5.2.3-2.rhaos4.17.el8, podman-4:5.2.3-2.rhaos4.17.el9 +14
  • RHSA-2024:8229 Released 2024-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.17.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:8329 Released 2024-10-22 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-db-rhel8, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle +6
  • RHSA-2024:8014 Released 2024-10-22 · Red Hat rating Important
    Network Observability 1.7.0 for OpenShift
    • NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
  • RHSA-2024:8112 Released 2024-10-15 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.9-1.el9_4, buildah-tests-2:1.33.9-1.el9_4
  • RHSA-2024:8111 Released 2024-10-15 · Red Hat rating Important
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.14.5-2.el9_4, skopeo-tests-2:1.14.5-2.el9_4
  • RHSA-2024:8110 Released 2024-10-15 · Red Hat rating Important
    containernetworking-plugins security update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.4.0-6.el9_4
  • RHSA-2024:8038 Released 2024-10-14 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.s390x::container-tools:rhel8 +47
  • RHSA-2024:8039 Released 2024-10-14 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-13.el9_4, podman-docker-4:4.9.4-13.el9_4, podman-plugins-4:4.9.4-13.el9_4 +2
  • RHSA-2024:7852 Released 2024-10-09 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+22336+84062bbb.x86_64::container-tools:rhel8, buildah-1:1.26.7-2.module+el8.6.0+22336+84062bbb.src::container-tools:rhel8, buildah-1:1.26.7-2.module+el8.6.0+22336+84062bbb.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+22336+84062bbb.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+22336+84062bbb.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+22336+84062bbb.s390x::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+22336+84062bbb.x86_64::container-tools:rhel8, buildah-1:1.26.7-2.module+el8.6.0+22336+84062bbb.src::container-tools:rhel8, buildah-1:1.26.7-2.module+el8.6.0+22336+84062bbb.x86_64::container-tools:rhel8 +47
  • RHSA-2024:7820 Released 2024-10-08 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) podman-2:4.4.1-20.el9_2.1, podman-docker-2:4.4.1-20.el9_2.1, podman-gvproxy-2:4.4.1-20.el9_2.1 +3
  • RHSA-2024:7819 Released 2024-10-08 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) buildah-1:1.29.3-1.el9_2.1, buildah-tests-1:1.29.3-1.el9_2.1
  • RHSA-2024:7821 Released 2024-10-08 · Red Hat rating Important
    skopeo security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) skopeo-2:1.11.2-0.1.el9_2.2, skopeo-tests-2:1.11.2-0.1.el9_2.2
  • RHSA-2024:7822 Released 2024-10-08 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.src::container-tools:rhel8, buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.x86_64::container-tools:rhel8, buildah-tests-1.21.4-4.module+el8.4.0+22344+c04f7483.x86_64::container-tools:rhel8 +40
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.ppc64le::container-tools:rhel8, buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.src::container-tools:rhel8, buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.src::container-tools:rhel8, buildah-1.21.4-4.module+el8.4.0+22344+c04f7483.x86_64::container-tools:rhel8, buildah-tests-1.21.4-4.module+el8.4.0+22344+c04f7483.x86_64::container-tools:rhel8 +40
  • RHSA-2024:7818 Released 2024-10-08 · Red Hat rating Important
    containernetworking-plugins security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) containernetworking-plugins-1:1.2.0-3.el9_2.1
  • RHSA-2024:7793 Released 2024-10-08 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) buildah-1:1.26.7-1.el9_0.1, buildah-tests-1:1.26.7-1.el9_0.1
  • RHSA-2024:7794 Released 2024-10-08 · Red Hat rating Important
    skopeo security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) skopeo-2:1.8.0-4.1.el9_0, skopeo-tests-2:1.8.0-4.1.el9_0
  • RHSA-2024:7792 Released 2024-10-08 · Red Hat rating Important
    containernetworking-plugins security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) containernetworking-plugins-1:1.0.1-6.el9_0.1
  • RHSA-2024:7791 Released 2024-10-08 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) podman-2:4.2.0-5.el9_0.1, podman-catatonit-2:4.2.0-5.el9_0.1, podman-docker-2:4.2.0-5.el9_0.1 +4
  • RHSA-2024:7769 Released 2024-10-07 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+22332+2132e5c3.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+22332+2132e5c3.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+22332+2132e5c3.s390x::container-tools:rhel8 +47
  • RHSA-2024:7485 Released 2024-10-02 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) golang-1.17.13-2.el9_0, golang-bin-1.17.13-2.el9_0, golang-docs-1.17.13-2.el9_0 +4
  • RHSA-2024:7487 Released 2024-10-02 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.src::go-toolset:rhel8 +9
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.aarch64::go-toolset:rhel8 +18
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-1.module+el8.6.0+21758+c87a29d6.src::go-toolset:rhel8 +9
  • RHSA-2024:7488 Released 2024-10-02 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-2.module+el8.4.0+12542+e3fec473.src::go-toolset:rhel8 +9
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-2.module+el8.4.0+12542+e3fec473.ppc64le::go-toolset:rhel8 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-2.module+el8.4.0+12542+e3fec473.src::go-toolset:rhel8 +9
  • RHSA-2024:7456 Released 2024-10-01 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) git-lfs-3.2.0-2.el8_8.2
  • RHSA-2024:7455 Released 2024-10-01 · Red Hat rating Moderate
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) git-lfs-2.13.3-3.el8_6.2
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) git-lfs-2.13.3-3.el8_6.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) git-lfs-2.13.3-3.el8_6.2
  • RHSA-2024:7449 Released 2024-10-01 · Red Hat rating Moderate
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-lfs-2.11.0-2.el8_4.3
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) git-lfs-2.11.0-2.el8_4.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) git-lfs-2.11.0-2.el8_4.3
  • RHSA-2024:7351 Released 2024-09-30 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) git-lfs-2.13.3-5.el9_0.2
  • RHSA-2024:7350 Released 2024-09-30 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) grafana-pcp-5.1.1-2.el9_2
  • RHSA-2024:7262 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101-2.el8_10, osbuild-composer-core-101-2.el8_10, osbuild-composer-worker-101-2.el8_10
  • RHSA-2024:7261 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) osbuild-composer-46.3-2.el8_6, osbuild-composer-core-46.3-2.el8_6, osbuild-composer-dnf-json-46.3-2.el8_6 +1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) osbuild-composer-46.3-2.el8_6, osbuild-composer-core-46.3-2.el8_6, osbuild-composer-dnf-json-46.3-2.el8_6 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) osbuild-composer-46.3-2.el8_6, osbuild-composer-core-46.3-2.el8_6, osbuild-composer-dnf-json-46.3-2.el8_6 +1
  • RHSA-2024:7203 Released 2024-09-26 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) git-lfs-3.2.0-2.el9_2.1
  • RHSA-2024:7204 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-101-2.el9_4, osbuild-composer-core-101-2.el9_4, osbuild-composer-worker-101-2.el9_4
  • RHSA-2024:7206 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) osbuild-composer-75-2.el8_8, osbuild-composer-core-75-2.el8_8, osbuild-composer-dnf-json-75-2.el8_8 +1
  • RHSA-2024:7207 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) osbuild-composer-76-3.el9_2.2, osbuild-composer-core-76-3.el9_2.2, osbuild-composer-dnf-json-76-3.el9_2.2 +1
  • RHSA-2024:7205 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) osbuild-composer-28.7-2.el8_4, osbuild-composer-core-28.7-2.el8_4, osbuild-composer-worker-28.7-2.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) osbuild-composer-28.7-2.el8_4, osbuild-composer-core-28.7-2.el8_4, osbuild-composer-worker-28.7-2.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) osbuild-composer-28.7-2.el8_4, osbuild-composer-core-28.7-2.el8_4, osbuild-composer-worker-28.7-2.el8_4
  • RHSA-2024:7208 Released 2024-09-26 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) osbuild-composer-46.3-2.el9_0, osbuild-composer-core-46.3-2.el9_0, osbuild-composer-dnf-json-46.3-2.el9_0 +1
  • RHSA-2024:7202 Released 2024-09-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) grafana-9.0.9-5.el9_2
  • RHSA-2024:7136 Released 2024-09-25 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.4.1-4.el9_4
  • RHSA-2024:7135 Released 2024-09-25 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-lfs-3.4.1-3.el8_10
  • RHSA-2024:7102 Released 2024-09-25 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) grafana-7.5.11-7.el9_0
  • RHSA-2024:7103 Released 2024-09-25 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) grafana-pcp-3.2.0-3.el9_0
  • RHSA-2024:6947 Released 2024-09-23 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-17.el9_4, grafana-selinux-9.2.10-17.el9_4
  • RHSA-2024:6946 Released 2024-09-23 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-5.1.1-3.el9_4
  • RHSA-2024:6912 Released 2024-09-23 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-2.module+el8.8.0+22004+c5f8797c.aarch64::go-toolset:rhel8 +18
  • RHSA-2024:6908 Released 2024-09-23 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64::go-toolset:rhel8, delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le::go-toolset:rhel8, delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src::go-toolset:rhel8 +19
  • RHSA-2024:6913 Released 2024-09-23 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.13-3.el9_4, golang-1.21.13-3.el9_4, golang-bin-1.21.13-3.el9_4 +4
  • RHSA-2024:6914 Released 2024-09-23 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) golang-1.19.13-12.el9_2, golang-bin-1.19.13-12.el9_2, golang-docs-1.19.13-12.el9_2 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Builds for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for Applications 7AffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Self Node Remediation OperatorAffectedNo fix planned: Will not fix
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
8Base-RHMTC-1.8Fixed RHSA-2024:10906
9Base-OADP-1.3Fixed RHSA-2024:9960
9Base-OADP-1.4Fixed RHSA-2025:0771
9Base-RHOSO-1.0-PODIFIEDFixed RHSA-2024:9485
9Base-Service-Interconnect-1.4Fixed—
Cryostat 3 on RHEL 8Fixed RHSA-2024:8329
Custom Metric Autoscaler operator for Red Hat Openshift 2.15Fixed RHSA-2025:3501
NETOBSERV 1.7 for RHEL 9Fixed RHSA-2024:8014
RHACS 4.4 for RHEL 8Fixed RHSA-2024:9583
RHACS 4.5 for RHEL 8Fixed RHSA-2024:10186
RHOL 5.6 for RHEL 8Fixed RHSA-2024:8318
RHOL 5.8 for RHEL 9Fixed RHSA-2024:8317
RHOL 5.9 for RHEL 9Fixed RHSA-2024:8315
RHOL 6.0 for RHEL 9Fixed RHSA-2024:8314
Red Hat Ceph Storage 5.3 ToolsFixed—
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2025:4240
Red Hat Ceph Storage 7.1 ToolsFixed—
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:9776
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:6908, RHSA-2024:7135, RHSA-2024:7262, RHSA-2024:8038
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:11216, RHSA-2024:11217, RHSA-2024:6913, RHSA-2024:6946, RHSA-2024:6947, RHSA-2024:7136, RHSA-2024:7204, RHSA-2024:8039, RHSA-2024:8110, RHSA-2024:8111, RHSA-2024:8112, RHSA-2024:9454, RHSA-2024:9456, RHSA-2024:9459, RHSA-2024:9472, RHSA-2024:9473, RHSA-2025:3773
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:7205, RHSA-2024:7449, RHSA-2024:7488, RHSA-2024:7822
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:7261, RHSA-2024:7455, RHSA-2024:7487, RHSA-2024:7852
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:7205, RHSA-2024:7449, RHSA-2024:7488, RHSA-2024:7822
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:7261, RHSA-2024:7455, RHSA-2024:7487, RHSA-2024:7852
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:7102, RHSA-2024:7103, RHSA-2024:7208, RHSA-2024:7351, RHSA-2024:7485, RHSA-2024:7791, RHSA-2024:7792, RHSA-2024:7793, RHSA-2024:7794
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:6912, RHSA-2024:7206, RHSA-2024:7456, RHSA-2024:7769
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:6914, RHSA-2024:7202, RHSA-2024:7203, RHSA-2024:7207, RHSA-2024:7350, RHSA-2024:7818, RHSA-2024:7819, RHSA-2024:7820, RHSA-2024:7821
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:7205, RHSA-2024:7449, RHSA-2024:7488, RHSA-2024:7822
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:7261, RHSA-2024:7455, RHSA-2024:7487, RHSA-2024:7852
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:8692, RHSA-2024:8694
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:8688, RHSA-2024:8690
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:8697, RHSA-2024:8700
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:8425, RHSA-2024:8428
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:8260, RHSA-2024:8263
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2024:8229, RHSA-2024:8232
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2024:10236
Red Hat OpenShift Service on AWS 1.0Fixed—
Red Hat OpenStack Platform 16.2Fixed RHSA-2024:10883, RHSA-2025:0203
Red Hat OpenStack Platform 17.1Fixed RHSA-2025:1190
Red Hat Openshift Data Foundation 4.15Fixed RHSA-2026:2172
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:2164
Red Hat Quay 3.10Fixed RHSA-2025:22182, RHSA-2025:23064, RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2025:23028, RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2025:23176
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942, RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2025:23546, RHSA-2026:2681
Red Hat Quay 3.9Fixed RHSA-2025:22287, RHSA-2025:23061, RHSA-2026:2754
Red Hat Service Interconnect 1.4Fixed—
Not affected: 32 products
  • 8Base-RHMTC-1.8
  • 9Base-OADP-1.3
  • 9Base-OADP-1.4
  • Custom Metric Autoscaler operator for Red Hat Openshift 2.15
  • Ironic content for Red Hat OpenShift Container Platform 4.12
  • Ironic content for Red Hat OpenShift Container Platform 4.17
  • Migration Toolkit for Virtualization
  • OpenShift Service Mesh 2
  • RHACS 4.4 for RHEL 8
  • RHACS 4.5 for RHEL 8
  • RHOL 6.0 for RHEL 9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces 3
  • Red Hat Openshift Data Foundation 4.15
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Sandboxed Containers
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-34156
  2. 2026-10-03 Alias added: GHSA-crqm-pwhx-j97f
  3. 2026-10-30 Fix available: Red Hat Ceph Storage 5.3 Tools, Red Hat OpenShift Service on AWS 1.0 · Red Hat

References

Other 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences