PT-2024-10470 · Google+6 · Golang+6
Guido Vranken
·
Published
2024-12-18
·
Updated
2026-04-09
·
CVE-2024-45338
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Golang versions prior to the fixed version
Description
The issue is related to uncontrolled resource consumption in the Golang programming language. An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
Recommendations
For Golang versions prior to the fixed version, consider disabling the
Parse functions until a patch is available. Restrict access to the vulnerable Parse functions to minimize the risk of exploitation. Avoid using the Parse functions in the affected API endpoints until the issue is resolved. Update to a version that includes the fix for this issue, such as the version that includes the upgrade of golang.org/x/net.Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Golang
Linuxmint
Red Os
Suse
Ubuntu