CVE-2024-34156 Stack exhaustion in Decoder.Decode in encoding/gob

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Stack Exhaustion Vulnerabilities in Go Libraries Identified Two stack exhaustion vulnerabilities have been reported in Go libraries. CVE-2024-34156 affects the Decoder.Decode function in the encoding/gob package, while CVE-2022-30631 impacts the compress/gzip package when reading certain archives. Both vulnerabilities have been documented by Microsoft as of February 18, 2026. 2 sources 39