Skip to content
Fencer Vulns
high 7.5

CVE-2024-37298 json

Potential memory exhaustion attack due to sparse slice deserialization

published 2024-07-01 2 y ago modified 2026-09-10 1 mo ago also GHSA-3669-72x9-r9p3 , GO-2024-2958 , EUVD-2024-2233

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

Patch / fix

  • go github.com/gorilla/schema 1.4.1
  • gorillatoolkit schema 1.4.1
  • golang-github-gorilla-schema Debian 14, Debian 13 1.4.1-1

debian advisories DEBIAN-CVE-2024-37298

  • crit RHEL 8 3.18-5.module+el8.10.0+22202+761b9a65
  • criu RHEL 8 3.18-5.module+el8.10.0+22202+761b9a65
  • crun RHEL 8 1.14.3-2.module+el8.10.0+22202+761b9a65
  • runc RHEL 8 1:1.1.12-4.module+el8.10.0+22202+761b9a65
  • udica RHEL 8 0.2.6-21.module+el8.10.0+22202+761b9a65
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+22202+761b9a65
  • podman RHEL 8 4:4.9.4-12.module+el8.10.0+22202+761b9a65
  • skopeo RHEL 8 2:1.14.5-3.module+el8.10.0+22202+761b9a65

red hat advisories RHSA-2024:5258RHSA-2024:5194RHSA-2024:5202RHSA-2024:6194RHSA-2024:5634RHSA-2024:4963

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git142.862ef23-1.1

opensuse advisories openSUSE-SU-2025:14663-1

  • podman AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-tests AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-docker AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-remote AlmaLinux 9 4:4.9.4-10.el9_4
  • podman-plugins AlmaLinux 9 4:4.9.4-10.el9_4
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3858+6ad51f9f
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8

almalinux advisories ALSA-2024:6194ALSA-2024:5258

  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-4.module+el8.10.0+1843+6892ab28
  • udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
  • conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
  • podman Rocky Linux 8 4:4.9.4-12.module+el8.10.0+1843+6892ab28
  • skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28
  • buildah Rocky Linux 8 2:1.33.8-4.module+el8.10.0+1843+6892ab28

rocky linux advisories RLSA-2024:5258

  • libcontainers-common CBL-Mariner 2.0 20210626-4
  • telegraf Azure Linux 3.0 1.31.0-2
  • libcontainers-common Azure Linux 3.0 20240213-2
  • telegraf CBL-Mariner 2.0 1.29.4-7
  • podman Azure Linux 3.0 5.6.1-2

azure linux advisories AZL-43071AZL-43083AZL-43103AZL-43146AZL-44949

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-37298 updated cvss 7.5

gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization

  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22202+761b9a65, criu 3.18-5.module+el8.10.0+22202+761b9a65, crun 1.14.3-2.module+el8.10.0+22202+761b9a65, runc 1.1.12-4.module+el8.10.0+22202+761b9a65, udica 0.2.6-21.module+el8.10.0+22202+761b9a65, conmon 2.1.10-1.module+el8.10.0+22202+761b9a65, +27 more
    fixed: vendor fix RHSA-2024:5258
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.9.4-10.el9_4, podman-tests 4.9.4-10.el9_4, podman-docker 4.9.4-10.el9_4, podman-remote 4.9.4-10.el9_4, podman-plugins 4.9.4-10.el9_4
    fixed: vendor fix RHSA-2024:6194
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) podman 4.2.0-5.el9_0, podman-tests 4.2.0-5.el9_0, podman-docker 4.2.0-5.el9_0, podman-remote 4.2.0-5.el9_0, podman-gvproxy 4.2.0-5.el9_0, podman-plugins 4.2.0-5.el9_0, +1 more
    fixed: vendor fix RHSA-2024:4825
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) crit 3.15-4.module+el8.8.0+22142+4cbed6b3, criu 3.15-4.module+el8.8.0+22142+4cbed6b3, crun 1.8.4-2.module+el8.8.0+22142+4cbed6b3, runc 1.1.12-1.module+el8.8.0+22142+4cbed6b3, conmon 2.1.6-1.module+el8.8.0+22142+4cbed6b3, udica 0.2.6-20.module+el8.8.0+22142+4cbed6b3, +27 more
    fixed: vendor fix RHSA-2024:5194
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) podman 4.4.1-20.el9_2, podman-tests 4.4.1-20.el9_2, podman-docker 4.4.1-20.el9_2, podman-remote 4.4.1-20.el9_2, podman-gvproxy 4.4.1-20.el9_2, podman-plugins 4.4.1-20.el9_2
    fixed: vendor fix RHSA-2024:5634
  • Red Hat OpenShift Container Platform 4.12 podman 4.4.1-7.rhaos4.12.el8, podman 4.2.0-11.rhaos4.12.el9, podman-tests 4.4.1-7.rhaos4.12.el8, podman-docker 4.4.1-7.rhaos4.12.el8, podman-remote 4.4.1-7.rhaos4.12.el8, podman-tests 4.2.0-11.rhaos4.12.el9, +8 more
    fixed: vendor fix RHSA-2024:5202
  • Red Hat OpenShift Container Platform 4.13 podman 4.4.1-9.3.rhaos4.13.el8, podman 4.4.1-10.3.rhaos4.13.el9, podman-tests 4.4.1-9.3.rhaos4.13.el8, podman-docker 4.4.1-9.3.rhaos4.13.el8, podman-remote 4.4.1-9.3.rhaos4.13.el8, podman-tests 4.4.1-10.3.rhaos4.13.el9, +7 more
    fixed: vendor fix RHSA-2024:4848
show 5 more
  • Red Hat OpenShift Container Platform 4.14 podman 4.4.1-16.4.rhaos4.14.el8, podman 4.4.1-16.4.rhaos4.14.el9, podman-tests 4.4.1-16.4.rhaos4.14.el8, podman-tests 4.4.1-16.4.rhaos4.14.el9, podman-docker 4.4.1-16.4.rhaos4.14.el8, podman-docker 4.4.1-16.4.rhaos4.14.el9, +7 more
    fixed: vendor fix RHSA-2024:4963
  • Red Hat OpenShift Container Platform 4.15 podman 4.4.1-25.2.rhaos4.15.el8, podman 4.4.1-25.2.rhaos4.15.el9, podman-tests 4.4.1-25.2.rhaos4.15.el8, podman-tests 4.4.1-25.2.rhaos4.15.el9, podman-docker 4.4.1-25.2.rhaos4.15.el8, podman-docker 4.4.1-25.2.rhaos4.15.el9, +7 more
    fixed: vendor fix RHSA-2024:4702
  • Red Hat OpenShift Container Platform 4.16 podman 4.9.4-8.rhaos4.16.el8, podman 4.9.4-9.rhaos4.16.el9, podman-tests 4.9.4-8.rhaos4.16.el8, podman-tests 4.9.4-9.rhaos4.16.el9, podman-docker 4.9.4-8.rhaos4.16.el8, podman-docker 4.9.4-9.rhaos4.16.el9, +6 more
    fixed: vendor fix RHSA-2024:4858
  • Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.5-4, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.5-2, advanced-cluster-security/rhacs-scanner-rhel8 4.4.5-2, advanced-cluster-security/rhacs-rhel8-operator 4.4.5-2, advanced-cluster-security/rhacs-collector-rhel8 4.4.5-2, advanced-cluster-security/rhacs-operator-bundle 4.4.5-3, +7 more
    fixed: vendor fix RHSA-2024:6054
  • Red Hat Enterprise Linux 10 podman Red Hat OpenShift Container Platform 4.12 cri-tools 1.25.0-4.el8, cri-tools 1.25.0-4.el9, runc 1.1.6-8.rhaos4.12.el8, perf 4.18.0-372.118.1.el8_6, conmon 2.1.2-7.rhaos4.12.el8, conmon 2.1.2-8.rhaos4.12.el9, +54 more Red Hat OpenShift Container Platform 4.14 perf 5.14.0-284.77.1.el9_2, rtla 5.14.0-284.77.1.el9_2, bpftool 7.0.0-284.77.1.el9_2, kernel 5.14.0-284.77.1.el9_2, wasmedge 0.14.0-1.rhaos4.14.el9, kernel-64k 5.14.0-284.77.1.el9_2, +74 more Red Hat OpenShift Container Platform 4.15 perf 5.14.0-284.75.1.el9_2, rtla 5.14.0-284.75.1.el9_2, bpftool 7.0.0-284.75.1.el9_2, kernel 5.14.0-284.75.1.el9_2, kernel-64k 5.14.0-284.75.1.el9_2, kernel-core 5.14.0-284.75.1.el9_2, +70 more Red Hat OpenShift Container Platform 4.16 perf 5.14.0-427.28.1.el9_4, rtla 5.14.0-427.28.1.el9_4, bpftool 7.3.0-427.28.1.el9_4, kernel 5.14.0-427.28.1.el9_4, kernel-rt 5.14.0-427.28.1.el9_4, kernel-64k 5.14.0-427.28.1.el9_4, +68 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/gorilla/schema
<1.4.1
1.4.1

Affected products

  • gorilla schema
  • gorillatoolkit schema

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.