CVE-2024-34155 is a denial-of-service vulnerability in the go/parser package of the Golang standard library. When any Parse function processes Go source code containing deeply nested literals, it can cause uncontrolled recursion resulting in stack exhaustion and a panic. This leads to resource consumption impacting availability. The vulnerability affects Red Hat OpenShift Data Foundation versions >=4.16 <4.17. Red Hat has not provided a mitigation that meets their criteria for ease of use, deployment, applicability, or stability, and no official fix has been released as of the advisory date.

The vulnerability can cause a denial of service by exhausting stack memory and causing the application to panic and crash when parsing specially crafted Go source code with deeply nested literals. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild. The issue is rated high severity by Red Hat due to its potential to disrupt service.

No mitigation that meets Red Hat Product Security criteria is currently available. Users are advised to monitor Red Hat advisories for updates and apply the security update once it becomes available. Prior to applying this update, ensure all previously released errata relevant to your system have been applied. Customers with a Technical Account Manager (TAM) can review this CVE directly with their TAM for guidance.