CVE-2024-45338

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GoCNA
---
---
CISA-ADPADP
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
Debian logo
Debian Releases
Debian Product
Codename
golang-golang-x-net
bullseye
postponed
bookworm
no-dsa
sid
1:0.27.0-2
fixed
trixie
1:0.27.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
adsys
plucky
Fixed 0.16.0ubuntu1
released
oracular
Fixed 0.15.2ubuntu0.1
released
noble
Fixed 0.14.3~24.04ubuntu0.1
released
jammy
Fixed 0.14.3~22.04ubuntu0.1
released
focal
Fixed 0.9.2~20.04.2ubuntu0.1
released
containerd
plucky
not-affected
oracular
not-affected
noble
not-affected
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
golang-golang-x-net
plucky
needed
oracular
needed
noble
Fixed 1:0.21.0+dfsg-1ubuntu0.1~esm1
released
jammy
Fixed 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1
released
focal
dne
golang-golang-x-net-dev
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
Fixed 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1
released
bionic
Fixed 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1
released
xenial
Fixed 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
released
google-guest-agent
plucky
not-affected
oracular
not-affected
noble
not-affected
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
juju-core
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
xenial
Fixed 2.3.7-0ubuntu0.16.04.1+esm1
released
lxd
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
not-affected
bionic
not-affected
xenial
not-affected
Common Weakness Enumeration
References
https://go.dev/cl/637536
https://go.dev/issue/70906
https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
https://pkg.go.dev/vuln/GO-2024-3333
https://security.netapp.com/advisory/ntap-20250221-0001/