CLEANSTART-2026-BW15516: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

Q: What attacker access is needed to trigger this issue?

The vulnerability is network-reachable, requires no privileges, and does not require user interaction. An attacker would need to cause the affected package to call Parse on a "// +build" build-tag line containing deeply nested expressions.

Q: What is the practical impact of successful exploitation?

Successful exploitation can cause a panic from stack exhaustion, resulting in denial of service. The provided vector indicates no confidentiality or integrity impact.

Q: How can I determine whether my deployment is exposed?

Review whether your use of cleanstart/argo-workflows processes attacker-controlled or otherwise untrusted build-tag lines and passes them to Parse. Exposure specifically depends on parsing "// +build" lines with deeply nested expressions.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-34158

Frequently Asked Questions

What attacker access is needed to trigger this issue?

The vulnerability is network-reachable, requires no privileges, and does not require user interaction. An attacker would need to cause the affected package to call Parse on a "// +build" build-tag line containing deeply nested expressions.

What is the practical impact of successful exploitation?

Successful exploitation can cause a panic from stack exhaustion, resulting in denial of service. The provided vector indicates no confidentiality or integrity impact.

How can I determine whether my deployment is exposed?

Review whether your use of cleanstart/argo-workflows processes attacker-controlled or otherwise untrusted build-tag lines and passes them to Parse. Exposure specifically depends on parsing "// +build" lines with deeply nested expressions.

CLEANSTART-2026-BW15516: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What attacker access is needed to trigger this issue?

What is the practical impact of successful exploitation?

How can I determine whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is needed to trigger this issue?

What is the practical impact of successful exploitation?

How can I determine whether my deployment is exposed?