Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

go-discover may run out of memory on deep data

published 1 month ago
Summary

The go-discover tool can use too much memory when it reads very deeply nested or recursive information, which could cause the program to stop working. This happens because there is no limit on how deep the data can be processed. Update the software to a version that adds a recursion limit or apply the recommended patch to avoid crashes.

What to do
  • Update cleanstart go-discover to version 0_git20250325-r4.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart go-discover < 0_git20250325-r4
Fix: upgrade to 0_git20250325-r4
Original advisory text
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Multiple security vulnerabilities affect the go-discover package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published17 Sep 2026
Updated17 Sep 2026
First seen17 Sep 2026
Sources
CLEANSTART-2026-RH13168 · OSV
Track software like this
Free during beta