CVE-2024-34158 Stack exhaustion in Parse in go/build/constraint

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in Go Language Parsing Functions Three vulnerabilities have been reported in Go language parsing functions, affecting various components. CVE-2024-34155 and CVE-2024-34158 both involve stack exhaustion issues, while CVE-2023-24537 is related to an infinite loop in parsing. These vulnerabilities could impact applications utilizing these Go packages. 3 sources 39