gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-podmanUpgrade aardvark-dnsUpgrade toolboxUpgrade buildahUpgrade podmanUpgrade netavarkUpgrade criu-libsUpgrade libslirpUpgrade podman-catatonitUpgrade containers-commonUpgrade conmonUpgrade criuUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade buildah-testsUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-pluginsUpgrade libslirp-develUpgrade udicaUpgrade crunUpgrade critUpgrade runcUpgrade skopeo-testsUpgrade container-selinuxUpgrade criu-develUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-gvproxyUpgrade podman-tests | Aug 15, 2024 | Jul 1, 2024 |
| Debian | — | Upgrade golang-github-gorilla-schemaNo solution exists | May 15, 2025 | Jul 1, 2024 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade runcUpgrade udicaUpgrade podman-gvproxyUpgrade podman-remoteUpgrade critUpgrade skopeoUpgrade fuse-overlayfsUpgrade criuUpgrade buildahUpgrade cockpit-podmanUpgrade podmanUpgrade netavarkUpgrade buildah-testsUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade podman-dockerUpgrade slirp4netnsUpgrade podman-testsUpgrade skopeo-testsUpgrade libslirp-develUpgrade python3-criuUpgrade podman-pluginsUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade conmonUpgrade libslirpUpgrade criu-develUpgrade crunUpgrade containers-commonUpgrade criu-libs | Oct 16, 2024 | Jun 30, 2024 |
| Redhat Openshift | — | Upgrade podman | Jul 26, 2024 | Jun 30, 2024 |
| Redhat_linux | — | Upgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade udicaUpgrade python3-criuUpgrade criu-debugsourceUpgrade runcUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade toolbox-debugsourceUpgrade fuse-overlayfsUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remoteUpgrade podman-catatonitUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade toolbox-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-debuginfoUpgrade podmanUpgrade aardvark-dnsUpgrade toolboxUpgrade criuUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade buildahUpgrade critUpgrade conmon-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirpUpgrade criu-develUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade libslirp-develUpgrade netavarkUpgrade containernetworking-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade conmon-debuginfoUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-podmanUpgrade python3-podmanUpgrade runc-debuginfoUpgrade conmonUpgrade podman-dockerUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade criu-debuginfoUpgrade containers-commonUpgrade skopeo-testsUpgrade container-selinuxUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade criu-libs | Sep 13, 2024 | Jul 1, 2024 |
| Rocky_linux | — | Upgrade podman-catatonitUpgrade podman-plugins-debuginfoUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade podmanUpgrade podman-testsUpgrade criuUpgrade podman-debuginfoUpgrade podman-catatonit-debuginfoUpgrade python3-criuUpgrade buildahUpgrade toolbox-debugsourceUpgrade toolbox-testsUpgrade critUpgrade criu-libs-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeoUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade conmonUpgrade aardvark-dnsUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade criu-develUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade netavarkUpgrade buildah-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade criu-debuginfoUpgrade containers-commonUpgrade skopeo-testsUpgrade crun-debugsource | Aug 22, 2024 | Jul 1, 2024 |
| Suse | — | Upgrade system-user-velociraptorUpgrade velociraptorUpgrade velociraptor-client | Dec 5, 2025 | Sep 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub