CVE-2026-19201: Google go-attestation DOS Vulnerability

CVE-2026-19201 Overview

CVE-2026-19201 is an uncontrolled recursion vulnerability [CWE-674] in the Windows System Integrity Policy Audit (SIPA) event log parser of Google go-attestation versions up to and including 0.6.1. The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth. The size guard that would otherwise limit input processing is bypassed on recursive execution paths. An attacker who supplies a crafted Windows event log with deeply nested elamAggregation headers can exhaust the goroutine call stack and trigger a fatal runtime error that crashes the verifier process.

Critical Impact
Remote attackers can crash any verifier application that parses attacker-influenced Windows event logs, producing a denial-of-service condition against attestation workflows.

Affected Products

Google go-attestation versions 0.0.0 through 0.6.1
Any Go-based verifier or attestation service that embeds the go-attestation Windows event parser
Fixed in Google go-attestation release v0.6.2

Discovery Timeline

2026-09-09 - CVE-2026-19201 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-19201

Vulnerability Analysis

The go-attestation library parses Windows attestation event logs, including SIPA records emitted by Early Launch Anti-Malware (ELAM) drivers. The parser walks nested elamAggregation structures using direct recursion in (*WinEvents).readELAMAggregation. Each nested sub-event triggers another recursive call into the same function.

The defect is a missing depth ceiling combined with an ineffective size guard on the recursive path. The size check that limits top-level parsing does not propagate into recursion, so nested payloads are not bounded by input length. Deeply nested structures therefore grow the Go call stack until the runtime aborts the process with a stack overflow.

Because Go treats stack exhaustion as an unrecoverable fatal error, the crash cannot be caught with recover(). The verifier terminates immediately, denying service to legitimate attestation clients until the process is restarted.

Root Cause

The root cause is unbounded recursion in readELAMAggregation. The function does not track or limit recursion depth, and the outer size validation is not re-applied to nested elamAggregation headers parsed during recursive descent.

Attack Vector

An attacker submits a specially crafted Windows event log containing a chain of nested elamAggregation sub-event headers to any service that uses go-attestation to verify or parse Windows attestation data. Exploitation requires no authentication and no user interaction. The result is a fatal stack overflow that crashes the verifier.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-hcm6-rjfh-f25p and Pull Request #506 for the technical fix.

Detection Methods for CVE-2026-19201

Indicators of Compromise

Repeated abrupt terminations of verifier or attestation service processes that link go-attestation.
Go runtime logs containing runtime: goroutine stack exceeds or fatal error: stack overflow originating in readELAMAggregation.
Ingest of Windows event log blobs with abnormally deep nesting of elamAggregation sub-events.

Detection Strategies

Inspect application crash logs and container restart events for the affected verifier services, correlating crashes with recent event log submissions.
Add server-side validation that counts nested elamAggregation headers in submitted event logs before handing them to the parser.
Instrument the parsing path with metrics on recursion depth and payload size, and alert on outliers.

Monitoring Recommendations

Track process exit codes and restart frequency for services depending on go-attestation and alert on sustained crash loops.
Log the source IP, tenant, or client identity associated with each submitted event log to attribute repeated malformed inputs.
Forward runtime stack traces to centralized logging so security teams can identify the offending function frames.

How to Mitigate CVE-2026-19201

Immediate Actions Required

Upgrade all deployments of go-attestation to v0.6.2 or later and rebuild dependent binaries.
Audit internal services and third-party components for transitive dependencies on github.com/google/go-attestation at versions <= 0.6.1.
Restrict which clients can submit Windows event logs to attestation verifiers until patches are deployed.

Patch Information

The fix is included in Google go-attestation release v0.6.2, which introduces bounds checking on nested elamAggregation parsing as described in Pull Request #506. Consult GitHub Security Advisory GHSA-hcm6-rjfh-f25p for the full advisory.

Workarounds

Place a validating proxy or WAF rule in front of the verifier that rejects event log payloads exceeding a conservative size threshold.
Run verifier processes under a supervisor that rate-limits restarts and quarantines clients whose submissions trigger repeated crashes.
Where feasible, disable Windows SIPA event log ingestion until the patched library is deployed.

bash

# Upgrade go-attestation to the patched release
go get github.com/google/go-attestation@v0.6.2
go mod tidy
go build ./...