PT-2024-27455 · Unknown+5 · Gorilla/Schema+5

Alexvasiluta

·

Published

2024-06-30

·

Updated

2025-01-17

·

CVE-2024-37298

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions gorilla/schema versions prior to 1.4.1
Description The issue concerns a memory exhaustion vulnerability in gorilla/schema. When schema.Decoder.Decode() is run on a struct that has a field of type []struct{...}, it opens up the possibility of malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. For instance, an attacker can specify a field of a large index in an array, causing the allocation of all preceding elements in the slice, which can lead to memory exhaustion. This can be exploited through API endpoints, such as /innocent endpoint?arr.10000000.X=1, where arr is an array of structs.
Recommendations For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints that use schema.Decoder.Decode() on structs with arrays of other structs to minimize the risk of exploitation. Avoid using schema.Decoder.Decode() on structs with arrays of other structs until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2024:5258
ALSA-2024:6194
ALSA-2024_5258
ALSA-2024_6194
AZL-43071
AZL-43083
AZL-43103
AZL-43146
AZL-43474
AZL-44949
CESA-2024_5258
CVE-2024-37298
GHSA-3669-72X9-R9P3
GO-2024-2958
INFSA-2024_5258
INFSA-2024_6194
OESA-2025-1053
OESA-2025-1054
OESA-2025-1055
OESA-2025-1056
OPENSUSE-SU-2025:14663-1
RHSA-2024:4702
RHSA-2024:4825
RHSA-2024:4848
RHSA-2024:4858
RHSA-2024:4963
RHSA-2024:5194
RHSA-2024:5202
RHSA-2024:5258
RHSA-2024:5634
RHSA-2024:6194
RHSA-2024_5258
RHSA-2024_6194
RLSA-2024:5258

Affected Products

Almalinux
Centos
Debian
Red Hat
Rocky Linux
Gorilla/Schema