CVE-2024-34158

Name

CVE-2024-34158

Description

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

Exploits

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
	https://go.dev/cl/611240
	https://go.dev/issue/69141
	https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
	https://pkg.go.dev/vuln/GO-2024-3107

CPE URI	Source package	Min version	Max version
	go/build/constraint	>= 0	< 1.22.7
	go/build/constraint	>= 1.23.0-0	< 1.23.1

References