{"id":"CVE-2024-34158","aliases":["GO-2024-3107","BIT-golang-2024-34158"],"title":"Stack exhaustion in Parse in go/build/constraint","summary":"Stack exhaustion in Parse in go/build/constraint","severity":"none","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.23.0-0, < 1.23.1"],"patched":["stdlib 1.23.1"],"published":"2024-09-06","updated":"2026-08-04","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2024-3107","references":[{"url":"https://go.dev/cl/611240"},{"url":"https://go.dev/issue/69141"},{"url":"https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"}],"tags":["osv","go"],"epss":0.01046,"epssPercentile":0.62175,"ingestedAt":"2026-08-04T19:12:35.965Z","slug":"CVE-2024-34158","body":"## Overview\n\nCalling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.\n\n## Affected packages\n\n- `stdlib >= 1.23.0-0, < 1.23.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.23.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}