CVE-2024-34156 is a vulnerability in the Go encoding/gob package where calling Decoder.Decode on messages with deeply nested structures can cause stack exhaustion and panic, resulting in denial of service. This is due to uncontrolled recursion in the decoding process. The issue affects Red Hat Quay versions >=3.9.0 and <3.9.18. Red Hat Quay 3.9.18 includes a fix for this vulnerability. The vulnerability has a CVSS v3 base score of 7.5 (high severity) as assessed by Red Hat, with an attack vector of network, low complexity, no privileges required, and no user interaction. The impact is high availability impact due to potential application crashes. No mitigation other than upgrading is currently available that meets Red Hat's criteria.

The vulnerability can cause denial of service by crashing applications that decode maliciously crafted deeply nested gob messages, leading to stack exhaustion and panic. This can result in system unavailability or crashes, affecting the reliability and availability of services using the affected Go package within Red Hat Quay. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Red Hat recommends upgrading Red Hat Quay to version 3.9.18 or later, which includes the fix for this vulnerability. No other mitigation options meeting Red Hat's criteria for ease of use, applicability, and stability are currently available. Ensure all previously released errata relevant to your system are applied before updating. Monitor Red Hat advisories for any further updates.