gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade skopeoUpgrade python3-podmanUpgrade criu-libsUpgrade podman-catatonitUpgrade toolbox-testsUpgrade libslirpUpgrade containers-commonUpgrade fuse-overlayfsUpgrade toolboxUpgrade aardvark-dnsUpgrade conmonUpgrade netavarkUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade podmanUpgrade buildahUpgrade criuUpgrade podman-gvproxyUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade criu-develUpgrade udicaUpgrade critUpgrade podman-dockerUpgrade podman-testsUpgrade runcUpgrade skopeo-testsUpgrade podman-pluginsUpgrade crunUpgrade podman-remoteUpgrade slirp4netnsUpgrade python3-criuUpgrade libslirp-devel | Aug 15, 2024 | Jul 1, 2024 |
| Debian | — | Upgrade golang-github-gorilla-schema | May 15, 2025 | Jul 1, 2024 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade libslirp-develUpgrade python3-criuUpgrade crunUpgrade skopeo-testsUpgrade conmonUpgrade criu-develUpgrade container-selinuxUpgrade libslirpUpgrade containers-commonUpgrade podman-pluginsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade udicaUpgrade podman-gvproxyUpgrade containernetworking-pluginsUpgrade buildahUpgrade critUpgrade criuUpgrade cockpit-podmanUpgrade skopeoUpgrade podman-testsUpgrade runcUpgrade podman-remoteUpgrade slirp4netnsUpgrade podman-dockerUpgrade podmanUpgrade netavarkUpgrade fuse-overlayfsUpgrade buildah-tests | Oct 16, 2024 | Jun 30, 2024 |
| Redhat Openshift | — | Upgrade podman | Jul 26, 2024 | Jun 30, 2024 |
| Redhat_linux | — | Upgrade toolbox-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade python3-criuUpgrade skopeoUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade runcUpgrade criuUpgrade libslirp-debuginfoUpgrade podmanUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade udicaUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolboxUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-catatonitUpgrade toolbox-debuginfoUpgrade buildahUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade critUpgrade libslirp-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-remote-debuginfoUpgrade python3-podmanUpgrade cockpit-podmanUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade criu-debuginfoUpgrade criu-libsUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade podman-testsUpgrade podman-dockerUpgrade conmon-debuginfoUpgrade slirp4netnsUpgrade netavarkUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade container-selinuxUpgrade containers-commonUpgrade conmon | Sep 13, 2024 | Jul 1, 2024 |
| Rocky_linux | — | Upgrade libslirp-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade toolbox-debuginfoUpgrade crunUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeoUpgrade runcUpgrade buildahUpgrade podman-testsUpgrade toolbox-testsUpgrade python3-criuUpgrade podman-debuginfoUpgrade podman-catatonit-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade critUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade crun-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-debugsourceUpgrade conmonUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirpUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade podman-pluginsUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade containers-commonUpgrade criu-develUpgrade runc-debuginfo | Aug 22, 2024 | Jul 1, 2024 |
| Suse | — | Upgrade system-user-velociraptorUpgrade velociraptor-clientUpgrade velociraptor | Dec 5, 2025 | Sep 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub