CVE-2024-24788: Malformed DNS message can cause infinite loop in net

Deferred

AliasesMGASA-2024-0181RHBA-2024:3840RHSA-2024:9200+699 more

Published 08-05-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-24788 is a medium (CVSS 5.9) Loop with Unreachable Exit Condition vulnerability in go standard library net. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62.6% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.99%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 18 · Related 450

OPENSUSE-SU-2024:13936-1 OPENSUSE-SU-2024:14076-1 RHEA-2024:7866 RHEA-2025:0507 RHSA-2024:4616 RHSA-2024:5291+94 more

Showing 100 of 450.

Timeline

08-05-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

CVSS metrics

5 scores · 5 sources · 1 version

v3.15.9

EPSS trend

Probability

0.99%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 1.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r12
actions-runner-controller-fips< 0.9.1-r1
actions-runner-controller-fips-compat< 0.9.1-r1
addon-resizer-fips< 1.8.21-r0
addon-resizer-fips-compat< 1.8.21-r0

argo-workflows-fips< 3.5.6-r2
atlantis< 0.27.3-r1
atlantis-fips< 0.27.3-r1
aws-ebs-csi-driver< 1.30.0-r1
aws-efs-csi-driver< 2.0.2-r1
aws-efs-csi-driver-fips< 1.7.0-r10
aws-flb-cloudwatch-compat-fips< 1.9.4-r3
aws-flb-cloudwatch-fips< 1.9.4-r3
aws-flb-firehose-compat-fips< 1.7.2-r3
aws-flb-firehose-fips< 1.7.2-r3
aws-flb-kinesis-compat-fips< 1.10.2-r4
aws-flb-kinesis-fips< 1.10.2-r4
aws-load-balancer-controller-fips< 2.7.2-r4
azure-aad-pod-identity-mic< 1.8.17-r9
azure-aad-pod-identity-nmi< 1.8.17-r9
bank-vaults< 1.20.4-r13
bank-vaults-fips< 1.20.4-r10
bank-vaults-template-fips< 1.20.4-r10
bom< 0.6.0-r5
boring-registry< 0.14.0-r1
boring-registry-fips< 0.14.0-r1
buildkitd< 0.13.2-r1
caddy< 2.7.6-r9
caddy-fips< 2.7.6-r6
cadvisor< 0.49.1-r7
cadvisor-fips< 0.49.1-r6
capslock< 0.2.2-r2
cass-operator-compat-fips< 1.20.0-r1
cass-operator-fips< 1.20.0-r1
cass-operator-fips-no-pvc-delete< 1.20.0-r1
cass-operator-fips-no-pvc-delete-compat< 1.20.0-r1
cert-exporter< 2.12.0-r5
cert-exporter-fips< 2.12.0-r6
cert-manager-webhook-pdns< 2.5.1-r3
cert-manager-webhook-pdns-fips< 2.5.1-r4
certificate-transparency< 1.1.8-r3
certificate-transparency-fips< 1.1.8-r4
certificate-transparency-fips-trillian-ctserver< 1.1.8-r4
cfssl< 1.6.5-r4
chainctl< 0.2.59-r0
chartmuseum< 0.16.1-r10
cilium-cli< 0.16.7-r1
cilium-fips-1.15< 1.15.4-r2
cilium-fips-1.15-clustermesh-apiserver< 1.15.4-r2
cilium-fips-1.15-container-init< 1.15.4-r2
cilium-fips-1.15-container-init-compat< 1.15.4-r2
cilium-fips-1.15-host-utils< 1.15.4-r2
cilium-fips-1.15-hubble-relay< 1.15.4-r2
cilium-fips-1.15-operator-aws< 1.15.4-r2
cilium-fips-1.15-operator-azure< 1.15.4-r2
cilium-fips-1.15-operator-generic< 1.15.4-r2
cloudflared< 2024.1.0-r10
configmap-reload< 0.13.0-r1
configmap-reload-fips< 0.12.0-r7
configmap-reload-fips-0.11< 0.11.1-r8
confluent-common-docker< 7.6.0-r5
conftest< 0.52.0-r1
conftest-fips< 0.52.0-r1
cortex< 1.17.0-r1
cortex-fips< 1.17.0-r1
cosign< 2.2.4-r4
cosign-fips< 2.2.4-r2
crane< 0.19.1-r5
cri-tools< 1.30.0-r2
croc< 9.6.15-r1
crossplane-provider-aws< 1.4.0-r1
crossplane-provider-azure< 1.1.0-r1
crossplane-provider-gcp< 1.1.0-r1
ctop< 0.7.7-r14
cue< 0.8.2-r1
cue-fips< 0.8.2-r1
dask-gateway< 2024.1.0-r4
delve< 1.22.1-r4
dex< 2.39.1-r2
dex-fips< 2.39.1-r1
dex-k8s-authenticator< 1.4.0-r9
dgraph< 23.1.1-r1
direnv< 2.34.0-r3
dive< 0.12.0-r5
docker-compose< 2.27.0-r1
docker-credential-acr-env< 0.7.0-r12
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.7.1-r11
docker-credential-gcr< 2.1.22-r5
dockerize< 0.7.0-r8
dockerize-fips< 0.7.0-r8
dynamic-localpv-provisioner< 4.0.0-r3
dynamic-localpv-provisioner-fips< 4.0.0-r4
eck-operator< 2.16.1-r4
eck-operator-compat< 2.16.1-r4
eksctl< 0.176.0-r1
etcd-3.4< 3.4.32-r1
etcd-3.5< 3.5.13-r3
etcd-fips-3.4< 3.4.32-r1
etcd-fips-3.5< 3.5.13-r4
external-secrets-fips< 0.9.17-r1
extism< 1.4.0-r0
falcoctl< 0.7.3-r9
falcoctl-fips< 0.7.3-r10
falcoctl-fips-0.4< 0.4.0-r9
falcosidekick< 2.28.0-r6
falcosidekick-fips< 2.28.0-r7
ferretdb< 1.21.0-r3
flannel< 0.25.1-r2
flux-image-reflector-controller< 0.32.0-r1
flux-kustomize-controller< 1.3.0-r1
flux-notification-controller< 1.3.0-r1
flux-source-controller< 1.3.0-r1
flyte< 1.12.0-r1
frp< 0.58.0-r1
fulcio< 1.4.5-r2
fulcio-fips< 1.4.5-r3
fuse-overlayfs-snapshotter< 1.0.8-r9
ghaudit< 0.4.0-r3
git-lfs< 3.5.1-r4
gitleaks< 8.18.2-r3
gitness< 3.0.0_beta6-r3
gke-gcloud-auth-plugin< 0.0.2-r10
glab< 1.40.0-r1
go-1.22< 1.22.3-r0
go-bindata< 3.1.3-r19
go-licenses< 1.6.0-r13
go-md2man< 2.0.4-r3
gobump< 0.7.7-r2
golangci-lint< 1.58.1-r0
gomplate< 3.11.7-r5
gops< 0.3.28-r10
gostatsd< 28.3.0-r2
gosu< 1.17-r5
gotenberg< 8.5.0-r1
govulncheck< 1.0.2-r4
grafana-agent-operator< 0.40.4-r2
grafana-operator< 5.9.0-r1
grpcurl< 1.9.1-r3
guac< 0.6.0-r1
harbor-cli< 0.0.1-r2
harbor-registry< 3.0.0_alpha1-r3
harbor-registry-fips< 3.0.0_alpha1-r4
harbor-scanner-trivy< 0.31.1-r1
harbor-scanner-trivy-fips< 0.31.1-r1
hcloud< 1.43.1-r1
hello-world-golang< 1.3-r3
helm< 3.14.4-r3
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-fips< 3.14.4-r2
helm-fips-3< 3.19.2-r0
helm-fips-4< 4.0.1-r1
helm-operator< 1.34.1-r5
helm-operator-fips< 1.34.1-r5
helm-push< 0.10.4-r10
hey< 0.1.4-r13
http-echo< 1.0.0-r6
hubble-ui< 0.13.0-r9
hubble-ui-backend-fips< 0.13.0-r8
influx< 2.7.5-r1
ip-masq-agent< 2.9.3-r11
jitsucom-bulker< 2.6.0-r1
jsonnet-bundler< 0.5.1-r4
k3d< 5.6.3-r2
k8sgpt< 0.3.30-r1
k9s< 0.32.4-r4
kaf< 0.2.8-r3
kafka_exporter< 1.7.0-r3
karpenter-0.35< 0.35.4-r2
karpenter-fips-0.35< 0.35.4-r2
karpenter-fips-0.36< 0.36.1-r1
kind< 0.22.0-r4
ko< 0.15.2-r9
ko-fips< 0.15.2-r6
kpt< 1.0.0_beta49-r6
ksops< 4.3.1-r1
kube-bench< 0.7.3-r2
kube-bench-fips< 0.7.3-r2
kube-oidc-proxy< 1.0.6-r8
kube-state-metrics< 2.12.0-r3
kube-state-metrics-2.6< 2.6.0-r13
kube-state-metrics-fips< 2.12.0-r4
kubebuilder< 3.14.2-r1
kubecolor< 0.3.2-r1
kubernetes-csi-driver-hostpath< 1.13.0-r4
kubernetes-csi-external-provisioner< 4.0.1-r2
kubernetes-csi-livenessprobe< 2.12.0-r5
kubernetes-csi-livenessprobe-2.10< 2.10.0-r10
kubernetes-csi-livenessprobe-fips< 2.12.0-r3
kubernetes-csi-livenessprobe-fips-2.10< 2.10.0-r11
kubernetes-dashboard< 2.7.0-r18
kubernetes-dashboard-fips< 2.7.0-r7
kubernetes-dashboard-metrics-scraper< 1.0.9-r16
kubernetes-dashboard-metrics-scraper-fips< 1.0.9-r6
kubernetes-dns-node-cache< 1.23.0-r6
kubernetes-ingress-defaultbackend< 1.29.1-r0
kubescape< 3.0.10-r1

Show all 198

Alpine2 products

forgejo< 7.0.3-r0
go< 1.21.10-r0 | < 1.22.3-r0

2 vendors · 200 products · Showing 200 of 588

References

32 links

go.dev/issue/66754WEBREPORT
go.dev/cl/578375WEBFIX
groups.google.com/g/golang-announce/c/wkkO4P9stm0REPORTWEB
pkg.go.dev/vuln/GO-2024-2824AdvisoryWEB
www.openwall.com/lists/oss-security/2024/05/08/3WEB
security.netapp.com/advisory/ntap-20240605-0002/Advisory
security.netapp.com/advisory/ntap-20240614-0001/Advisory
advisories.mageia.org/MGASA-2024-0181.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=33197REPORT
www.openwall.com/lists/oss-security/2024/05/08/3WEB

Show all 32 references