CVE catalog

CVE-2026-19201

DEBIAN-CVE-2026-19201

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.27% · Oct 25, 2026

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth limit, while the size guard is bypassed on recursive execution paths. By submitting a crafted Windows event log containing deeply nested elamAggregation headers, an attacker can exhaust the goroutine call stack, triggering an unrecoverable fatal runtime error (stack overflow) that immediately crashes the verifier application.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-google-go-attestation140.5.1-1vulnerable
Debiangolang-github-google-go-attestation140.5.1-2vulnerable
Debiangolang-github-google-go-attestation140.6.0-1vulnerable
Debiangolang-github-google-go-attestation140.6.0-1~bpo13+1vulnerable
Debiangolang-github-google-go-attestation140.6.1-1vulnerable
Debiangolang-github-google-go-attestation140.6.1-2vulnerable
Debiangolang-github-google-go-attestation140.6.1-3vulnerable
Debiangolang-github-google-go-attestation140.6.1-4vulnerable
Debiangolang-github-google-go-attestation140.6.1-5vulnerable
Debiangolang-github-google-go-attestation140.6.4-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-google-go-attestationdeb140.6.4-1Not reportedDEBIAN-CVE-2026-19201Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]