Uncontrolled Recursion in Google go-attestation Affects Windows SIPA Event Log Parser

CVE-2026-19201

What is CVE-2026-19201?

A vulnerability has been identified in the Windows SIPA event log parser of the go-attestation product by Google. This issue arises from an uncontrolled recursion process within the (*WinEvents).readELAMAggregation function, which fails to impose a maximum recursion depth limit. Attackers can exploit this by crafting a malicious Windows event log with deeply nested elamAggregation headers, potentially leading to a denial of service (DoS). During execution, the absence of a size guard can result in the exhaustion of the goroutine call stack, culminating in an unrecoverable runtime error and causing the verifier application to crash.

References