CVE-2024-37298
Published: 1 July 2024
gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
golang-github-gorilla-schema
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
| jammy |
Does not exist
|
|
| mantic |
Ignored
(end of life, was needs-triage)
|
|
| noble |
Needs triage
|
|
| upstream |
Needs triage
|