CVE-2024-34156: Decoder.Decode DOS Vulnerability

CVE-2024-34156 Overview

CVE-2024-34156 is a stack exhaustion vulnerability in Go's encoding/gob package that allows remote attackers to cause a denial of service condition. When Decoder.Decode processes a message containing deeply nested structures, it can trigger a panic due to stack exhaustion. This vulnerability is a follow-up to CVE-2022-30635, indicating that previous mitigation attempts were insufficient to fully address the underlying recursive parsing issue.

Critical Impact

Remote attackers can crash Go applications that process untrusted gob-encoded data by sending specially crafted messages with deeply nested structures, leading to service unavailability.

Affected Products

• Go encoding/gob package (versions prior to security patch)
• Applications using Decoder.Decode to process untrusted gob-encoded data
• NetApp products (per NetApp Security Advisory)

Discovery Timeline

• 2024-09-06 - CVE-2024-34156 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-34156

Vulnerability Analysis

This vulnerability exists in Go's encoding/gob package, specifically within the Decoder.Decode function. The gob encoding format supports complex nested data structures, but the decoder implementation uses recursive function calls to process these structures. When an attacker crafts a message with excessively deep nesting levels, each level of nesting triggers additional recursive calls, eventually consuming all available stack space and causing the Go runtime to panic.

The vulnerability is particularly dangerous because it can be triggered remotely without authentication. Any application that accepts gob-encoded data from untrusted sources—such as network services, RPC endpoints, or file parsers—is potentially vulnerable. The fact that this is a follow-up to CVE-2022-30635 suggests that the original fix did not account for all possible nesting scenarios or attack vectors.

Root Cause

The root cause is insufficient depth checking during recursive decoding of nested structures in the encoding/gob package. While Go typically handles recursion efficiently, the decoder fails to implement proper safeguards against maliciously deep structures. The recursive nature of the decode function means that each nested element adds a new stack frame, and without explicit depth limits, an attacker can force unbounded recursion.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft a malicious gob-encoded payload with deeply nested data structures and send it to any service that processes gob data using Decoder.Decode. When the vulnerable application attempts to decode this payload, the recursive parsing consumes stack memory until exhaustion, triggering a panic that crashes the application.

The attack is particularly effective because gob encoding is commonly used in Go applications for inter-process communication, RPC frameworks, and data serialization, making the attack surface potentially quite large.

Detection Methods for CVE-2024-34156

Indicators of Compromise

• Unexpected application crashes with stack overflow or panic errors
• Log entries showing runtime panics in encoding/gob package functions
• Abnormally large or deeply nested gob-encoded payloads in network traffic
• Service restarts coinciding with receipt of specific network requests

Detection Strategies

• Monitor application logs for panic messages originating from encoding/gob decoder functions
• Implement network traffic analysis to identify unusually structured gob payloads
• Deploy runtime monitoring to detect abnormal stack usage patterns in Go applications
• Use application performance monitoring to identify sudden service crashes

Monitoring Recommendations

• Configure alerting for Go runtime panics in production environments
• Implement request logging for all endpoints accepting gob-encoded data
• Monitor memory and stack usage metrics for Go applications processing external data
• Establish baseline behavior patterns to detect anomalous request handling times

How to Mitigate CVE-2024-34156

Immediate Actions Required

• Update Go to the latest patched version that addresses this vulnerability
• Audit applications to identify all usage of encoding/gob.Decoder.Decode with untrusted input
• Consider implementing input validation or switching to alternative serialization formats for untrusted data
• Deploy rate limiting and request size restrictions on endpoints accepting gob-encoded data

Patch Information

The Go team has released a fix for this vulnerability. The patch is available through the Go.dev Code Review and tracked in the Go.dev Issue Tracker. Additional details can be found in the Go.dev Vulnerability Report and the Google Groups Discussion.

Organizations should update to the latest Go version that includes this security fix. For systems that cannot be immediately patched, consider implementing the workarounds below.

Workarounds

• Avoid using encoding/gob for processing data from untrusted sources
• Implement application-level depth limits before passing data to the gob decoder
• Use alternative serialization formats such as JSON or Protocol Buffers for untrusted input
• Deploy network-level filtering to reject abnormally large payloads before they reach the application

# Verify Go version and update to patched release
go version
go install golang.org/dl/go1.23@latest
go1.23 download