CVE-2026-19201 | CVSS: N/A
An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth limit, while the size guard is bypassed on recursive execution paths. By submitting a crafted Windows event log containing deeply nested elamAggregation headers, an attacker can exhaust the goroutine call stack, triggering an unrecoverable fatal runtime error (stack
参考链接:
• https://github.com/google/go-attestation/pull/506
• https://github.com/google/go-attestation/releases/tag/v0.6.2
• https://github.com/google/go-attestation/security/advisories/GHSA-hcm6-rjfh-f25p
📌 数据来源: NVD 官方