CLEANSTART-2026-IY91708: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion

Q: Who can trigger this issue?

An attacker needs the ability to supply Go source code to any affected Parse function. The attack requires low privileges and no user interaction, and can be performed over a network-exposed path if one accepts and parses attacker-controlled source.

Q: What is the practical impact of successful exploitation?

Deeply nested literals in the supplied Go source can exhaust the stack and cause a panic. This can make the affected parsing operation or service unavailable; the provided vector indicates no confidentiality or integrity impact.

Q: How can I determine whether my deployment is exposed?

Review whether your use of cleanstart/argo-workflows invokes Parse functions on Go source code that can be influenced by users or remote clients. Deployments that only parse trusted, bounded source input are less directly exposed to attacker-triggered exploitation.

Q: What can be done if an update is not immediately available?

Do not pass untrusted Go source to Parse functions, or enforce input controls that reject excessively nested literals before parsing. Isolate parsing workloads so a panic or resource-exhaustion event does not take down the wider service.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-34155

Frequently Asked Questions

Who can trigger this issue?

An attacker needs the ability to supply Go source code to any affected Parse function. The attack requires low privileges and no user interaction, and can be performed over a network-exposed path if one accepts and parses attacker-controlled source.

What is the practical impact of successful exploitation?

Deeply nested literals in the supplied Go source can exhaust the stack and cause a panic. This can make the affected parsing operation or service unavailable; the provided vector indicates no confidentiality or integrity impact.

How can I determine whether my deployment is exposed?

Review whether your use of cleanstart/argo-workflows invokes Parse functions on Go source code that can be influenced by users or remote clients. Deployments that only parse trusted, bounded source input are less directly exposed to attacker-triggered exploitation.

What can be done if an update is not immediately available?

Do not pass untrusted Go source to Parse functions, or enforce input controls that reject excessively nested literals before parsing. Isolate parsing workloads so a panic or resource-exhaustion event does not take down the wider service.

CLEANSTART-2026-IY91708: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can trigger this issue?

What is the practical impact of successful exploitation?

How can I determine whether my deployment is exposed?

What can be done if an update is not immediately available?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger this issue?

What is the practical impact of successful exploitation?

How can I determine whether my deployment is exposed?

What can be done if an update is not immediately available?