Read the docs
TI-2024-24810 Aliases CVE-2024-37298GHSA-3669-72x9-r9p3

Potential memory exhaustion attack due to sparse slice deserialization

Priority HIGH 72CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01096 65th percentileScored 2026-11-07
Fix Partial schema (gorilla): 1.4.1github.com/gorilla/schema (Go): 1.4.1Red Hat: 11 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gorillaschemabefore 1.4.11.4.1Patch availableCNA
—github.com/gorilla/schema (Go)before 1.4.11.4.1Patch availableGHSA-3669-72x9-r9p3
  • schema Vendorgorilla Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
  • github.com/gorilla/schema (Go) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-3669-72x9-r9p3

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:gorillatoolkit:schema:*:*:*:*:*:*:*:*——Gorillatoolkit
  • cpe:2.3:a:gorillatoolkit:schema:*:*:*:*:*:*:*:* Versions — — ·Gorillatoolkit

Remediation

  • Fix · CNA schema (gorilla) Fixed in 1.4.1
  • Fix · GHSA-3669-72x9-r9p3 github.com/gorilla/schema (Go) Fixed in 1.4.1 Advisory →

Red Hat 11 advisories

  • RHSA-2024:6194 Released 2024-09-03 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-10.el9_4, podman-docker-4:4.9.4-10.el9_4, podman-plugins-4:4.9.4-10.el9_4 +2
  • RHSA-2024:6054 Released 2024-08-29 · Red Hat rating Important
    ACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:5634 Released 2024-08-20 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) podman-2:4.4.1-20.el9_2, podman-docker-2:4.4.1-20.el9_2, podman-gvproxy-2:4.4.1-20.el9_2 +3
Show 8 more Red Hat advisories
  • RHSA-2024:5202 Released 2024-08-19 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.63 packages and security update
    • Red Hat OpenShift Container Platform 4.12 cri-o-1.25.3-7.rhaos4.12.git44a2cb2.el9, cri-o-1.25.5-25.rhaos4.12.git6556f50.el8, podman-3:4.2.0-11.rhaos4.12.el9 +13
  • RHSA-2024:5258 Released 2024-08-13 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.s390x::container-tools:rhel8 +47
  • RHSA-2024:5194 Released 2024-08-12 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+22142+4cbed6b3.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+22142+4cbed6b3.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+22142+4cbed6b3.s390x::container-tools:rhel8 +47
  • RHSA-2024:4963 Released 2024-08-07 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.34 security update
    • Red Hat OpenShift Container Platform 4.14 podman-3:4.4.1-16.4.rhaos4.14.el8, podman-3:4.4.1-16.4.rhaos4.14.el9, podman-catatonit-3:4.4.1-16.4.rhaos4.14.el8 +10
  • RHSA-2024:4848 Released 2024-07-31 · Red Hat rating Important
    OpenShift Container Platform 4.13.46 security update
    • Red Hat OpenShift Container Platform 4.13 podman-3:4.4.1-10.3.rhaos4.13.el9, podman-3:4.4.1-9.3.rhaos4.13.el8, podman-catatonit-3:4.4.1-9.3.rhaos4.13.el8 +10
  • RHSA-2024:4858 Released 2024-07-31 · Red Hat rating Moderate
    OpenShift Container Platform 4.16.5 packages and security update
    • Red Hat OpenShift Container Platform 4.16 podman-4:4.9.4-8.rhaos4.16.el8, podman-4:4.9.4-9.rhaos4.16.el9, podman-catatonit-4:4.9.4-8.rhaos4.16.el8 +9
  • RHSA-2024:4702 Released 2024-07-25 · Red Hat rating Important
    OpenShift Container Platform 4.15.23 packages and security update
    • Red Hat OpenShift Container Platform 4.15 podman-3:4.4.1-25.2.rhaos4.15.el8, podman-3:4.4.1-25.2.rhaos4.15.el9, podman-catatonit-3:4.4.1-25.2.rhaos4.15.el8 +10
  • RHSA-2024:4825 Released 2024-07-24 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) podman-2:4.2.0-5.el9_0, podman-catatonit-2:4.2.0-5.el9_0, podman-docker-2:4.2.0-5.el9_0 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
RHACS 4.4 for RHEL 8Fixed RHSA-2024:6054
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:5258
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:6194
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:4825
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:5194
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:5634
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:5202
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:4848
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:4963
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:4702
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:4858
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37298
  2. 2026-10-03 Alias added: GHSA-3669-72x9-r9p3

References

Advisory 1

Other 4

  • TI-2025-18101 gorilla/csrf CSRF vulnerability due to broken Referer validation CVSS 4.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences