CVE-2024-45338 Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can cause a denial of service by crafting input that triggers non-linear parsing in the Go HTML library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45338?
CVE-2024-45338 is a medium-severity denial of service vulnerability in golang.org/x/net/html, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Weakness: CWE-1333
Which versions are affected by CVE-2024-45338?
3 open source packages ship an affected version, including golang.org/x/net/html and golang.org/x/net.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net/html Go | All versions | 0.33.0 |
golang.org/x/net/html Go | All versions | 0.33.0 |
golang.org/x/net Go | All versions | 0.33.0 |
Linux distribution packages (9)
hauler openSUSE:Tumbleweed | All versions | 1.1.1-2.1 |
helm openSUSE:Tumbleweed | All versions | 3.17.0-2.1 |
helmfile openSUSE:Tumbleweed | All versions | 0.170.0-1.1 |
kepler openSUSE:Tumbleweed | All versions | 0.7.11-2.1 |
kubelogin openSUSE:Tumbleweed | All versions | 0.1.7-1.1 |
kured openSUSE:Tumbleweed | All versions | 1.17.1-1.1 |
sops openSUSE:Tumbleweed | All versions | 3.9.3-1.1 |
teleport openSUSE:Tumbleweed | All versions | 17.1.0-1.1 |
yq openSUSE:Tumbleweed | All versions | 4.44.6-1.1 |
How do I fix CVE-2024-45338?
Upgrade golang.org/x/net/html to 0.33.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-45338 being exploited?
There is no known exploitation of CVE-2024-45338 in the wild and no public exploit code.
Sources
Also known as AZL-54398, AZL-54401, AZL-54404, AZL-54407, AZL-54410, AZL-54413 and 138 more.