This vulnerability exists in the encoding/gob package of the Golang standard library, which Red Hat Quay depends on. When the Decoder.Decode function processes messages with excessively deep nested structures, it can cause a stack exhaustion panic, resulting in application crashes or denial of service. This issue is a follow-up to CVE-2022-30635 and is classified under multiple CWEs related to uncontrolled recursion and resource exhaustion. The vulnerability affects Red Hat Quay versions >=3.16.0 and <3.16.2. Red Hat Quay 3.16.2 contains the fix for this issue. The vulnerability has a CVSS v3 base score of 7.5 (high severity) as assessed by Red Hat, with network attack vector, low complexity, no privileges required, and high availability impact. No mitigation other than upgrading to the fixed version is currently recommended by Red Hat.

The vulnerability can cause denial of service by exhausting stack memory during decoding of crafted messages with deeply nested structures. This can lead to application crashes or unavailability of Red Hat Quay services that rely on the affected Golang package. There is no impact on confidentiality or integrity reported. No known exploits are currently observed in the wild.

Red Hat has released Red Hat Quay version 3.16.2 which fixes this vulnerability. Users should upgrade to version 3.16.2 or later to remediate the issue. No other effective mitigations meeting Red Hat's criteria are currently available. Applying all previously released errata before this update is recommended. Monitor Red Hat advisories for any further updates.