gorilla github.com/gorilla/schema vulnerabilities

Latest gorilla github.com/gorilla/schema CVEs

Newest publication first

1. CVE-2024-37298 Potential memory exhaustion attack due to sparse slice deserialization

   Published 2024-07-01

   High·CVSS 7.5 EPSS 1.1%

   gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. An...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.