gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade skopeoUpgrade aardvark-dnsUpgrade toolbox-testsUpgrade buildah-testsUpgrade python3-podmanUpgrade cockpit-podmanUpgrade buildahUpgrade conmonUpgrade criuUpgrade toolboxUpgrade podmanUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade netavarkUpgrade criu-libsUpgrade podman-catatonitUpgrade libslirpUpgrade libslirp-develUpgrade podman-gvproxyUpgrade critUpgrade criu-develUpgrade podman-testsUpgrade runcUpgrade podman-pluginsUpgrade podman-remoteUpgrade skopeo-testsUpgrade crunUpgrade slirp4netnsUpgrade podman-dockerUpgrade python3-criuUpgrade udicaUpgrade containernetworking-pluginsUpgrade container-selinux | Aug 15, 2024 | Jul 1, 2024 |
| Debian | — | Upgrade golang-github-gorilla-schemaNo solution exists | May 15, 2025 | Jul 1, 2024 |
| Oracle_linux | — | Upgrade criuUpgrade runcUpgrade podman-testsUpgrade critUpgrade udicaUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade buildahUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade podman-remoteUpgrade skopeoUpgrade podmanUpgrade podman-catatonitUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade netavarkUpgrade podman-dockerUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade libslirpUpgrade container-selinuxUpgrade python3-podmanUpgrade libslirp-develUpgrade containers-commonUpgrade python3-criuUpgrade crunUpgrade podman-pluginsUpgrade skopeo-testsUpgrade criu-devel | Oct 16, 2024 | Jun 30, 2024 |
| Redhat Openshift | — | Upgrade podman | Jul 26, 2024 | Jun 30, 2024 |
| Redhat_linux | — | Upgrade python3-podmanUpgrade conmonUpgrade runc-debuginfoUpgrade containers-commonUpgrade crun-debuginfoUpgrade libslirp-develUpgrade podman-dockerUpgrade containernetworking-plugins-debugsourceUpgrade criu-debuginfoUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade criu-libsUpgrade podman-testsUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade netavarkUpgrade conmon-debuginfoUpgrade crunUpgrade container-selinuxUpgrade criu-develUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade containernetworking-pluginsUpgrade udicaUpgrade criu-libs-debuginfoUpgrade podman-debuginfoUpgrade aardvark-dnsUpgrade podmanUpgrade libslirp-debuginfoUpgrade buildah-debuginfoUpgrade criuUpgrade toolbox-testsUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade python3-criuUpgrade runcUpgrade podman-remoteUpgrade podman-catatonitUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade conmon-debugsourceUpgrade podman-pluginsUpgrade podman-gvproxy-debuginfoUpgrade toolboxUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade buildahUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfo | Sep 13, 2024 | Jul 1, 2024 |
| Rocky_linux | — | Upgrade crunUpgrade fuse-overlayfsUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-testsUpgrade skopeoUpgrade criuUpgrade criu-libs-debuginfoUpgrade libslirp-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonit-debuginfoUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade podmanUpgrade buildahUpgrade runcUpgrade podman-remoteUpgrade buildah-testsUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade criu-develUpgrade runc-debuginfoUpgrade crun-debugsourceUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade criu-libsUpgrade criu-debuginfoUpgrade containers-commonUpgrade buildah-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade criu-debugsourceUpgrade conmonUpgrade libslirp-develUpgrade toolboxUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hook | Aug 22, 2024 | Jul 1, 2024 |
| Suse | — | Upgrade velociraptor-clientUpgrade velociraptorUpgrade system-user-velociraptor | Dec 5, 2025 | Sep 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub