What’s Vulnerable › Vulnerabilities

CVE-2024-34158: Stack exhaustion in Parse in go/build/constraint

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-06 · updated 2026-06-17
• Weakness: CWE-674

Description

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

Affected products

• Go Build Constraint Go Standard Library: before 1.22.7; from 1.23.0-0 before 1.23.1 — fixed in 1.22.7, 1.23.1

How to fix

Upgrade to a fixed version: Go Build Constraint Go Standard Library 1.22.7, 1.23.1. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/611240
• https://go.dev/issue/69141
• https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
• https://pkg.go.dev/vuln/GO-2024-3107
• https://security.netapp.com/advisory/ntap-20241004-0003/

Get alerted when CVE-2024-34158 or the next vulnerability affects your stack