CVE-2024-34156 is a vulnerability in the encoding/gob package of the Golang standard library used by Red Hat Quay 3.10.18. The Decoder.Decode function can panic due to stack exhaustion when processing messages with deeply nested structures, caused by uncontrolled recursion. This can be exploited by an attacker to cause a denial of service by crashing the application. The issue is a follow-up to CVE-2022-30635 and is rated high severity by Red Hat with a CVSS v3 score of 7.5. Red Hat Quay 3.10.18 includes fixes addressing this and other issues. However, no direct mitigation or patch for the Go library flaw currently meets Red Hat's criteria for deployment. Users should ensure all prior errata are applied and update to Quay 3.10.18 to receive the latest fixes.

The vulnerability allows an attacker to cause a denial of service by sending crafted messages with deeply nested structures that exhaust the stack during decoding, leading to application crashes. This impacts the availability of services relying on Red Hat Quay 3.10.18 when processing untrusted input. There is no impact on confidentiality or integrity reported. No known exploits are currently observed in the wild.

Red Hat has released Quay 3.10.18 containing fixes for this issue and recommends applying this update along with all previously released errata relevant to the system. Currently, no direct mitigation for the underlying Go encoding/gob package flaw meets Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates and apply them promptly. No additional mitigations are specified by Red Hat at this time.