CVE-2024-34156 is a vulnerability in the Go encoding/gob package where calling Decoder.Decode on messages with deeply nested structures can cause a stack exhaustion panic. This recursive decoding leads to resource exhaustion, resulting in application crashes or denial of service. The vulnerability affects Red Hat Quay versions >=3.15.0 and <3.15.3. Red Hat has released Quay 3.15.3 which includes fixes for this issue. The vulnerability is rated high severity due to its potential to cause service unavailability. No public exploits are known. The vulnerability is related to several CWEs including uncontrolled recursion and path traversal issues.

The vulnerability can cause denial of service by crashing applications that use the vulnerable Go encoding/gob package to decode deeply nested data structures. This can lead to system unavailability or service disruption in affected Red Hat Quay versions. There is no impact on confidentiality or integrity reported. No known active exploitation in the wild has been observed.

Red Hat Quay users should upgrade to version 3.15.3 or later, which includes fixes for this vulnerability. No other effective mitigations meeting Red Hat's criteria are currently available. Applying all previously released errata before updating is recommended. Monitor Red Hat advisories for any further updates.