CVE-2024-37298: gorilla/schema DoS Vulnerability

CVE-2024-37298 Overview

CVE-2024-37298 is a memory exhaustion vulnerability in the gorilla/schema Go library, which converts structs to and from form values. The flaw exists in versions prior to 1.4.1 and is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. When schema.Decoder.Decode() processes a struct containing a field of type []struct{...}, attackers can abuse the sparse slice functionality to trigger unbounded memory allocations. Any application that decodes form data into structs containing nested struct arrays is exposed to this denial-of-service condition. Version 1.4.1 contains the patch.

Critical Impact
Remote, unauthenticated attackers can exhaust server memory by submitting crafted form values, leading to denial of service in Go web applications that depend on gorilla/schema.

Affected Products

gorilla/schema Go module versions prior to 1.4.1
Go web applications that call schema.Decoder.Decode() on structs containing []struct{...} fields
Downstream services consuming HTTP form data through the affected decoder

Discovery Timeline

2024-07-01 - CVE-2024-37298 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-37298

Vulnerability Analysis

The gorilla/schema decoder supports populating slice fields from indexed form keys, such as items.0.name, items.1.name, and so on. The decoder relies on the numeric index supplied by the client to size the destination slice. When the destination field is []struct{...}, the decoder allocates a slice large enough to accommodate the highest index seen in the request.

Attackers can submit a single form parameter with an extremely large index value. The decoder then attempts to allocate a sparse slice spanning every index up to that bound. The allocation is driven entirely by untrusted input and is not capped, which exhausts available memory and crashes the process.

This affects any HTTP handler that decodes form bodies or query strings into Go structs containing nested struct slices. The attack is unauthenticated and requires a single HTTP request.

Root Cause

The root cause is missing validation of the maximum slice index parsed from form input. The decoder logic at decoder.go line 223 grows the destination slice to match attacker-controlled indices without enforcing a ceiling or comparing against reasonable bounds. This maps to [CWE-770], allocation of resources without limits or throttling.

Attack Vector

Exploitation requires only network access to an endpoint that invokes schema.Decoder.Decode() on a struct containing a []struct{...} field. An attacker submits a form parameter such as field.<largeIndex>.subfield=value, where <largeIndex> is a very large integer. The decoder then attempts to allocate a slice sized to that index, consuming heap memory until the Go runtime aborts the process. No authentication or user interaction is required.

The vulnerability mechanism is documented in the gorilla/schema security advisory GHSA-3669-72x9-r9p3 and the vulnerable code path in decoder.go.

Detection Methods for CVE-2024-37298

Indicators of Compromise

HTTP requests containing form parameters with unusually large numeric indices in dotted or bracketed key paths (for example, items.99999999.name)
Sudden spikes in Go process resident memory followed by runtime: out of memory errors or process termination
Repeated OOMKilled events on containers running Go services that consume HTTP form data

Detection Strategies

Inspect dependency manifests (go.mod, go.sum) for github.com/gorilla/schema versions earlier than v1.4.1
Add web application firewall rules that flag form keys containing numeric segments exceeding a reasonable threshold
Review application logs for decode failures, panics, or restarts correlated with inbound form submissions

Monitoring Recommendations

Track per-process memory growth and garbage collection pause metrics on Go services exposed to untrusted form input
Alert on abnormal request body sizes and high-cardinality form keys on public-facing endpoints
Correlate process restart events with upstream HTTP request payloads to identify exploitation attempts

How to Mitigate CVE-2024-37298

Immediate Actions Required

Upgrade github.com/gorilla/schema to version 1.4.1 or later across all Go services
Audit handlers that call schema.Decoder.Decode() on structs containing []struct{...} fields
Enforce request size limits on HTTP endpoints that accept form-encoded data

Patch Information

The maintainers released version 1.4.1 containing the fix. The patch is documented in the upstream commit cd59f2f and the GHSA-3669-72x9-r9p3 advisory. Update the dependency with go get github.com/gorilla/schema@v1.4.1 followed by go mod tidy, then rebuild and redeploy affected binaries.

Workarounds

Place a reverse proxy or WAF in front of affected services to reject form keys with numeric indices above a safe limit
Validate or constrain incoming form data before passing it to the decoder, rejecting payloads with sparse or oversized array indices
Apply per-request body size limits using http.MaxBytesReader to cap memory pressure from untrusted clients

bash

# Configuration example
go get github.com/gorilla/schema@v1.4.1
go mod tidy
go build ./...