gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slirp4netnsUpgrade podman-gvproxyUpgrade crunUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade criu-develUpgrade container-selinuxUpgrade critUpgrade podman-remoteUpgrade podman-dockerUpgrade udicaUpgrade libslirp-develUpgrade podman-testsUpgrade skopeo-testsUpgrade podman-pluginsUpgrade runcUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade libslirpUpgrade podman-catatonitUpgrade criu-libsUpgrade toolboxUpgrade toolbox-testsUpgrade netavarkUpgrade fuse-overlayfsUpgrade skopeoUpgrade python3-podmanUpgrade buildah-testsUpgrade containers-commonUpgrade cockpit-podmanUpgrade criuUpgrade podmanUpgrade conmon | Aug 15, 2024 | Jul 1, 2024 |
| Debian | — | Upgrade golang-github-gorilla-schema | May 15, 2025 | Jul 1, 2024 |
| Oracle_linux | — | Upgrade critUpgrade podman-testsUpgrade udicaUpgrade runcUpgrade podman-gvproxyUpgrade buildah-testsUpgrade netavarkUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade podman-dockerUpgrade podman-remoteUpgrade slirp4netnsUpgrade podmanUpgrade podman-catatonitUpgrade buildahUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade skopeoUpgrade criuUpgrade libslirpUpgrade containers-commonUpgrade crunUpgrade podman-pluginsUpgrade python3-criuUpgrade criu-libsUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade libslirp-develUpgrade criu-develUpgrade container-selinuxUpgrade conmon | Oct 16, 2024 | Jun 30, 2024 |
| Redhat Openshift | — | Upgrade podman | Jul 26, 2024 | Jun 30, 2024 |
| Redhat_linux | — | Upgrade criu-develUpgrade buildah-tests-debuginfoUpgrade libslirp-develUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade podman-debugsourceUpgrade criu-debuginfoUpgrade criu-libsUpgrade podman-gvproxyUpgrade podman-testsUpgrade slirp4netnsUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade crun-debuginfoUpgrade python3-podmanUpgrade cockpit-podmanUpgrade runc-debuginfoUpgrade containers-commonUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade libslirpUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-dockerUpgrade crunUpgrade criuUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade podmanUpgrade runc-debugsourceUpgrade crun-debugsourceUpgrade buildahUpgrade toolbox-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade udicaUpgrade podman-catatonit-debuginfoUpgrade python3-criuUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade runcUpgrade aardvark-dnsUpgrade podman-pluginsUpgrade criu-libs-debuginfoUpgrade libslirp-debugsourceUpgrade critUpgrade toolboxUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podman-catatonitUpgrade podman-remote-debuginfoUpgrade fuse-overlayfsUpgrade podman-gvproxy-debuginfoUpgrade conmon-debugsourceUpgrade libslirp-debuginfo | Sep 13, 2024 | Jul 1, 2024 |
| Rocky_linux | — | Upgrade podman-gvproxyUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade libslirpUpgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade runc-debuginfoUpgrade criu-debuginfoUpgrade criu-libsUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debugsourceUpgrade runc-debugsourceUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade containers-commonUpgrade criu-develUpgrade skopeo-testsUpgrade crun-debuginfoUpgrade runcUpgrade slirp4netns-debuginfoUpgrade podman-catatonitUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crunUpgrade skopeoUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade podmanUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade podman-plugins-debuginfoUpgrade criuUpgrade podman-testsUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade buildahUpgrade python3-criuUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade criu-libs-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade fuse-overlayfsUpgrade toolbox-debuginfoUpgrade podman-remote | Aug 22, 2024 | Jul 1, 2024 |
| Suse | — | Upgrade system-user-velociraptorUpgrade velociraptor-clientUpgrade velociraptor | Dec 5, 2025 | Sep 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub