CVE-2024-34158: 
Go vulnerability analysis and mitigation

A vulnerability was identified in the Go programming language's build/constraint package, tracked as CVE-2024-34158. The vulnerability was discovered and disclosed on September 6, 2024. The issue affects Go versions prior to 1.22.7 and versions from 1.23.0-0 before 1.23.1. When calling Parse on a '// +build' build tag line containing deeply nested expressions, it can trigger a panic due to stack exhaustion (Go Project, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue specifically occurs in the go/build/constraint package of the Golang standard library when parsing build tag lines with deeply nested expressions. The vulnerability is categorized under CWE-674 (Uncontrolled Recursion) (CISA-ADP).

The successful exploitation of this vulnerability can lead to a Denial of Service (DoS) condition through stack exhaustion when parsing build tag lines. This can affect the availability of applications using the affected Go versions (Go Vuln).

The vulnerability has been fixed in Go versions 1.22.7 and 1.23.1. Users are advised to upgrade to these patched versions to mitigate the issue. The fix was released on September 5, 2024, as part of minor point releases (Go Project).