Medium 6.6Published Sep 8, 2026

CVE-2026-19201Denial of Service via Unbounded Recursion in go-attestation Windows SIPA Parser

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects Google go-attestation and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Google go-attestation

Exploited in the last 30 days

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth limit, while the size guard is bypassed on recursive execution paths. By submitting a crafted Windows event log containing deeply nested elamAggregation headers, an attacker can exhaust the goroutine call stack, triggering an unrecoverable fatal runtime error (stack overflow) that immediately crashes the verifier application.

CVSS: 6.6 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness (CWE): CWE-674
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Google
NVD analysis: Analyzed
Record last updated: Sep 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Google go-attestation google:go_attestation (from the name)	from 0.0.0 through 0.6.1	CNA record
google go-attestation google:go-attestation	through 0.6.1	NVD

References

https://github.com/google/go-attestation/pull/506patch, vendor-advisory
https://github.com/google/go-attestation/releases/tag/v0.6.2patch, release-notes
https://github.com/google/go-attestation/security/advisories/GHSA-hcm6-rjfh-f25pbroken-link

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.