CVE-2024-45338

MEDIUM5.3

Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected products

golang.org/x/net / golang.org/x/net/html0 – 0.33.0

References

MISChttps://go.dev/cl/637536
MISChttps://go.dev/issue/70906
MISChttps://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
MISChttps://pkg.go.dev/vuln/GO-2024-3333

Updated 10m ago · 8 sources