CVE-2024-34156 is a vulnerability in the Go encoding/gob package where calling Decoder.Decode on messages containing deeply nested structures can cause stack exhaustion and panic. This is due to uncontrolled recursion in the decoding process. The issue can be exploited by sending crafted messages with excessive nesting, leading to denial of service by crashing the application. This vulnerability affects Red Hat Quay versions from 3.15.0 up to but not including 3.15.4. Red Hat has published an advisory and released Quay 3.15.4 with fixes. No mitigations meeting Red Hat's criteria are currently available other than upgrading.

The vulnerability allows an attacker to cause denial of service by triggering a stack overflow panic in applications using the vulnerable Go encoding/gob package. This can lead to application crashes and unavailability, impacting service reliability. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been observed.

Red Hat has released Quay version 3.15.4 which includes fixes for this vulnerability. Users should upgrade to version 3.15.4 or later to remediate the issue. No other mitigations meeting Red Hat's criteria are currently available. Applying this update is the recommended and supported remediation.