CVE-2024-24790: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Modified

AliasesSUSE-SU-2025:0302-1SUSE-SU-2025:0377-1RHSA-2024:8876+1063 more

Published 05-06-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-24790 is a critical (CVSS 9.8) vulnerability in go standard library net/netip. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

1.95%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 31 · Related 696

MGASA-2024-0217 OPENSUSE-SU-2024:14020-1 OPENSUSE-SU-2024:14023-1 RHEA-2025:0507 RHSA-2024:4212 RHSA-2024:4237+94 more

Showing 100 of 714.

Timeline

05-06-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS metrics

8 scores · 8 sources · 1 version

v3.19.8

EPSS trend

Probability

1.95%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.95% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r13
actions-runner-controller< 0.9.2-r1
actions-runner-controller-fips< 0.9.2-r2
addon-resizer< 1.8.21-r1
addon-resizer-fips< 1.8.21-r3

age< 1.1.1-r1
amass< 4.2.0-r11
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.5.7-r1
atlantis< 0.28.1-r1
atlantis-fips< 0.28.1-r1
aws-ebs-csi-driver< 1.31.0-r1
aws-efs-csi-driver-fips< 1.7.0-r11
aws-flb-cloudwatch< 1.9.4-r11
aws-flb-cloudwatch-fips< 1.9.4-r4
aws-flb-firehose< 1.7.2-r11
aws-flb-firehose-fips< 1.7.2-r4
aws-flb-kinesis< 1.10.2-r12
aws-flb-kinesis-fips< 1.10.2-r5
aws-load-balancer-controller< 2.8.1-r1
aws-load-balancer-controller-fips< 2.8.0-r1
azure-aad-pod-identity-mic< 1.8.17-r10
bank-vaults< 1.20.4-r14
bank-vaults-fips< 1.20.4-r11
bazelisk< 1.20.0-r1
bom< 0.6.0-r6
boring-registry< 0.14.0-r2
boring-registry-fips< 0.14.0-r4
buf< 1.32.2-r1
buildah< 1.36.0-r1
buildkitd< 0.13.2-r2
caddy< 2.8.4-r1
caddy-fips< 2.8.4-r1
cadvisor< 0.49.1-r8
cadvisor-fips< 0.49.1-r7
capslock< 0.2.2-r3
cass-operator< 1.21.0-r1
cass-operator-fips< 1.21.0-r1
cass-operator-fips-no-pvc-delete< 1.21.0-r1
cert-exporter< 2.12.0-r6
cert-exporter-fips< 2.12.0-r7
cert-manager-webhook-pdns< 2.5.1-r4
cert-manager-webhook-pdns-fips< 2.5.1-r5
certificate-transparency< 1.2.1-r1
certificate-transparency-fips< 1.2.1-r1
cfssl< 1.6.5-r5
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r1
chezmoi< 2.48.2-r1
cilium-1.15< 1.15.5-r1
cilium-cli< 0.16.9-r1
cilium-fips-1.15< 1.15.5-r2
cloud-sql-proxy-fips< 2.11.3-r1
cloudflared< 2024.1.0-r11
cluster-proportional-autoscaler< 1.8.11-r7
cni-plugins< 1.5.0-r1
cni-plugins-fips< 1.5.0-r1
configmap-reload< 0.13.0-r2
configmap-reload-fips< 0.12.0-r8
configmap-reload-fips-0.11< 0.11.1-r9
confluent-common-docker< 7.6.0-r6
conftest< 0.52.0-r3
conftest-fips< 0.52.0-r3
controller-gen< 0.15.0-r5
cortex< 1.17.1-r1
cortex-fips< 1.17.1-r3
cosign< 2.2.4-r5
cosign-fips< 2.2.4-r3
crane< 0.19.1-r6
cri-tools< 1.30.0-r3
croc< 10.0.7-r1
crossplane-provider-aws< 1.4.0-r3
crossplane-provider-azure< 1.1.0-r3
crossplane-provider-gcp< 1.1.0-r3
ctop< 0.7.7-r15
cue-fips< 0.8.2-r2
dagdotdev< 0.0.3-r1
dagger< 0.11.6-r1
dask-gateway< 2024.1.0-r5
dataplaneapi< 2.9.3-r1
dataplaneapi-fips< 2.9.3-r1
delve< 1.22.1-r5
dex< 2.40.0-r1
dex-fips< 2.40.0-r1
dex-k8s-authenticator< 1.4.0-r10
dgraph< 23.1.1-r2
direnv< 2.34.0-r4
dive< 0.12.0-r7
docker< 26.1.3-r1
docker-compose< 2.27.1-r1
docker-credential-acr-env< 0.7.0-r13
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.8.0-r1
docker-credential-gcr< 2.1.22-r6
dockerize< 0.7.0-r9
dockerize-fips< 0.7.0-r9
doppler-kubernetes-operator< 1.5.1-r2
dynamic-localpv-provisioner< 4.0.0-r4
dynamic-localpv-provisioner-fips< 4.0.0-r5
envoy-ratelimit< 0.0_git20240220-r11
envoy-ratelimit-fips< 0.0_git20231206-r8
etcd-3.4< 3.4.32-r2
etcd-3.5< 3.5.14-r1
etcd-fips-3.4< 3.4.32-r2
etcd-fips-3.5< 3.5.13-r5
external-secrets-fips< 0.9.19-r1
extism< 1.5.0-r1
falcoctl< 0.8.0-r1
falcoctl-fips< 0.8.0-r1
falcoctl-fips-0.4< 0.4.0-r10
falcosidekick< 2.28.0-r7
falcosidekick-fips< 2.28.0-r9
ferretdb< 1.21.0-r4
flannel< 0.25.3-r1
flannel-cni-plugin< 1.4.1-r4
fluent-bit-plugin-loki< 3.0.0-r2
fluent-operator< 2.8.0-r1
fluent-operator-fips< 2.8.0-r1
flux< 2.3.0-r1
flux-helm-controller< 1.0.1-r2
flux-image-automation-controller< 0.38.0-r3
flux-image-reflector-controller< 0.32.0-r2
flux-kustomize-controller< 1.3.0-r3
flux-notification-controller< 1.3.0-r3
flux-source-controller< 1.3.0-r2
flyte< 1.12.0-r2
fq< 0.11.0-r5
frp< 0.58.1-r1
fulcio< 1.4.5-r3
fulcio-fips< 1.4.5-r4
fuse-overlayfs-snapshotter< 1.0.8-r10
gcsfuse< 1.4.2-r8
gh< 2.50.0-r1
ghaudit< 0.4.0-r4
git-lfs< 3.5.1-r6
git-lfs-fips< 3.5.1-r1
gitleaks< 8.18.3-r1
gitness< 3.0.0_beta6-r4
gitsign< 0.10.2-r2
gke-gcloud-auth-plugin< 0.0.2-r11
glab< 1.41.0-r1
go-1.20All versions (No fix recorded)
go-1.21< 1.21.11-r0
go-1.22< 1.22.4-r0
go-bindata< 3.1.3-r21
go-licenses< 1.6.0-r14
go-md2man< 2.0.4-r4
gobump< 0.7.7-r3
gobuster< 3.6.0-r12
golangci-lint< 1.59.0-r1
gomplate< 3.11.8-r1
gomplate-fips< 3.11.7-r1
gops< 0.3.28-r11
gostatsd< 28.3.0-r4
gosu< 1.17-r6
gosu-1.11< 1.11-r1
govulncheck< 1.0.2-r5
gpu-feature-discovery< 0.8.2-r1 | < 0.8.2-r2
grafana-agent-operator< 0.41.0-r1
grafana-mimir< 2.12.0-r1
grafana-operator< 5.9.2-r1
grafana-operator-fips< 5.9.2-r1
grpc-health-probe< 0.4.26-r3
grpc-health-probe-fips< 0.4.26-r1
grpcurl< 1.9.1-r4
grype< 0.78.0-r1
haproxy-ingress< 0.14.6-r8
harbor-2.9-portal-nginx-config< 2.9.4-r4
harbor-cli< 0.0.1-r3
harbor-registry< 3.0.0_alpha1-r4
harbor-registry-fips< 3.0.0_alpha1-r5
harbor-scanner-trivy< 0.31.2-r2
harbor-scanner-trivy-fips< 0.31.2-r2
hcloud< 1.43.1-r2
hello-world-golang< 1.3-r4
helm< 3.15.1-r1
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-docs< 1.13.1-r1
helm-fips< 3.15.1-r2
helm-fips-3< 3.19.2-r0
helm-fips-4< 4.0.1-r1
helm-operator< 1.34.2-r1
helm-operator-fips< 1.34.2-r2
helm-push< 0.10.4-r11
hey< 0.1.4-r14
hivemind< 1.1.0-r1
http-echo< 1.0.0-r7
hubble-ui< 0.13.1-r1
hubble-ui-backend-fips< 0.13.1-r1
influx< 2.7.5-r2
ip-masq-agent< 2.9.3-r12
istio-pilot-agent-1.22< 1.22.0-r2
istio-pilot-discovery-1.22< 1.22.0-r2
jitsucom-bulker< 2.7.0-r1
jsonnet-bundler< 0.5.1-r5
k3d< 5.6.3-r3
k3s< 1.30.1-r1
k8sgpt< 0.3.32-r2

Show all 199

Alpine1 product

go≥ 1.22.0, < 1.22.4-r0

2 vendors · 200 products · Showing 200 of 878

References

31 links

go.dev/cl/590316REPORTWEBFIXPatch
go.dev/issue/67680REPORTWEBIssue Tracking
groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJREPORTWEBRelease Notes
pkg.go.dev/vuln/GO-2024-2887REPORTWEBThird Party Advisory
www.openwall.com/lists/oss-security/2024/06/04/1WEBMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20240905-0002/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20250302-1/Advisory
bugzilla.suse.com/1225974REPORT
bugzilla.suse.com/1236406REPORT
bugzilla.suse.com/1236407REPORT

Show all 31 references

www.suse.com/security/cve/CVE-2024-24790WEB
www.suse.com/support/update/announcement/2025/suse-su-20250377-1/Advisory
access.redhat.com/errata/RHSA-2024:8876Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2292787REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8876.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-24790REPORT
www.cve.org/CVERecord?id=CVE-2024-24790AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-24790AdvisoryOval
ubuntu.com/security/CVE-2024-24790REPORT
groups.google.com/g/golang-announce/c/XbxouI9gY7kREPORT
github.com/golang/go/issues/67680REPORT
github.com/golang/go/commit/12d5810cdb1f73cf23d7a86462143e9463317fcaREPORT
github.com/golang/go/commit/051bdf3fd12a40307606ff9381138039c5f452f0REPORT
ubuntu.com/security/notices/USN-6886-1Advisory
ubuntu.com/security/notices/USN-7109-1Advisory
security-tracker.debian.org/tracker/CVE-2024-24790Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24790.jsonAdvisory
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2024-24790Advisory