CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html

Deferred

AliasesMGASA-2026-0190UBUNTU-CVE-2024-45338USN-7197-1+3606 more

Published 18-12-2024Last modified 21-02-2025

Vulnerability summary

CVE-2024-45338 is a medium (CVSS 5.3) vulnerability in golang.org/x/net golang.org/x/net/html. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.07%

0%100%

Low · +0.20 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 438

MGASA-2026-0147 OPENSUSE-SU-2024:14603-1 OPENSUSE-SU-2025:0056-1 OPENSUSE-SU-2025:0094-1 OPENSUSE-SU-2025:14613-1 OPENSUSE-SU-2025:14634-1+94 more

Showing 100 of 439.

Timeline

18-12-2024
PublishedVulnerability first disclosed.
21-02-2025
Last modifiedVulnerability information updated.

Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

CVSS metrics

8 scores · 8 sources · 2 versions

v4.08.7v3.15.3

EPSS trend

Probability

1.07%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

Increase +0.20 pp

From 0.87% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r21
actions-runner-controller< 0.10.1-r1
actions-runner-controller-compat< 0.10.1-r1
actions-runner-controller-fips< 0.10.1-r1
addon-resizer< 1.8.22-r4

addon-resizer-compat< 1.8.22-r4
addon-resizer-fips< 1.8.22-r3
addon-resizer-fips-compat< 1.8.22-r3
amass< 4.2.0-r15
amazon-cloudwatch-agent< 1.300051.0-r2
amazon-cloudwatch-agent-all< 1.300051.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300051.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300051.0-r2
amazon-cloudwatch-agent-compat< 1.300051.0-r2
amazon-cloudwatch-agent-config-downloader< 1.300051.0-r2
amazon-cloudwatch-agent-config-downloader-fips< 1.300051.0-r2
amazon-cloudwatch-agent-config-translator< 1.300051.0-r2
amazon-cloudwatch-agent-config-translator-fips< 1.300051.0-r2
amazon-cloudwatch-agent-fips< 1.300051.0-r2
amazon-cloudwatch-agent-operator< 2.0.1-r1
amazon-cloudwatch-agent-operator-compat< 2.0.1-r1
amazon-cloudwatch-agent-operator-fips< 2.0.1-r1
amazon-cloudwatch-agent-operator-fips-compat< 2.0.1-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300051.0-r2
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300051.0-r2
amazon-k8s-cni< 1.19.0-r1
amazon-k8s-cni-compat< 1.19.0-r1
amazon-k8s-cni-fips< 1.19.0-r1
amazon-k8s-cni-init< 1.19.0-r1
amazon-k8s-cni-init-compat< 1.19.0-r1
amazon-k8s-cni-init-fips< 1.19.0-r1
amazon-k8s-cni-init-fips-compat< 1.19.0-r1
amazon-ssm-agent< 3.3.1957.0-r5
amazon-ssm-agent-ecs-exec< 3.3.1957.0-r5
ansible-operator< 1.37.0-r1
ansible-operator-compat< 1.37.0-r1
apache-beam-java-11-sdk< 2.61.0-r1
apache-beam-java-17-sdk< 2.61.0-r1
apache-beam-java-21-sdk< 2.61.0-r1
apache-beam-java-sdk< 2.61.0-r1
apache-beam-python-3.11-sdk< 2.61.0-r1
apko< 0.25.5-r0
argo-cd-2.11< 2.11.12-r2
argo-cd-2.13< 2.13.2-r2
argo-cd-2.13-compat< 2.13.2-r2
argo-cd-2.13-repo-server< 2.13.2-r2
argo-events< 1.9.3-r2
argo-events-fips< 1.9.3-r2
argo-rollouts< 1.7.2-r3
argo-rollouts-fips< 1.7.2-r3
argo-workflows< 3.6.2-r2
argo-workflows-fips< 3.6.2-r2
argocd-image-updater< 0.15.1-r1
argocd-image-updater-compat< 0.15.1-r1
argocd-image-updater-fips< 0.15.1-r1
atlantis< 0.31.0-r2
atlantis-fips< 0.32.0-r0
auditbeat-7< 7.17.26-r2
auditbeat-7-oci-entrypoint< 7.17.26-r2
auditbeat-fips-7< 7.17.26-r2
authservice< 1.0.3-r3
authservice-compat< 1.0.3-r3
authservice-fips< 1.0.3-r2
authservice-fips-compat< 1.0.3-r2
aws-application-networking-k8s< 1.1.0-r1
aws-application-networking-k8s-compat< 1.1.0-r1
aws-ebs-csi-driver< 1.38.1-r2
aws-efs-csi-driver< 2.1.2-r3
aws-efs-csi-driver-fips< 2.1.2-r2
aws-iam-authenticator< 0.6.29-r1
aws-load-balancer-controller< 2.11.0-r1
aws-load-balancer-controller-compat< 2.11.0-r1
aws-load-balancer-controller-fips< 2.11.0-r1
aws-network-policy-agent< 1.2.0-r1
aws-network-policy-agent-compat< 1.2.0-r1
aws-network-policy-agent-compat-fips< 1.1.5-r1
aws-network-policy-agent-fips< 1.1.5-r1
aws-privateca-issuer< 1.4.0-r2
aws-privateca-issuer-compat< 1.4.0-r2
aws-privateca-issuer-compat-fips< 1.4.0-r2
aws-privateca-issuer-fips< 1.4.0-r2
azcopy< 10.27.1-r2
azcopy-fips< 10.27.1-r2
azure-aad-pod-identity-mic< 1.8.17-r15
azure-aad-pod-identity-nmi< 1.8.17-r15
azuredisk-csi-1.28< 1.28.11-r5
azuredisk-csi-1.28-compat< 1.28.11-r5
azuredisk-csi-1.29< 1.29.11-r2
azuredisk-csi-1.29-compat< 1.29.11-r2
azuredisk-csi-1.30< 1.30.6-r2
azuredisk-csi-1.30-compat< 1.30.6-r2
azuredisk-csi-1.31< 1.31.1-r2
azuredisk-csi-1.31-compat< 1.31.1-r2
azuredisk-csi-fips-1.28< 1.28.11-r4
azuredisk-csi-fips-1.29< 1.29.11-r2
azuredisk-csi-fips-1.30< 1.30.6-r2
azuredisk-csi-fips-1.31< 1.31.1-r2
bank-vaults< 1.20.4-r22
bank-vaults-fips< 1.20.4-r18
bank-vaults-template< 1.20.4-r22
bank-vaults-template-fips< 1.20.4-r18
beats-7< 7.17.26-r2
beats-fips-7< 7.17.26-r2
bom< 0.6.0-r13
boring-registry< 0.15.4-r4
boring-registry-fips< 0.15.4-r3
buf< 1.47.2-r3
buildah< 1.38.0-r2
buildctl< 0.18.2-r1
buildctl-fips< 0.18.2-r1
buildkitd< 0.18.2-r1
buildkitd-fips< 0.18.2-r1
caddy< 2.8.4-r7
caddy-fips< 2.8.4-r6
caddy-man< 2.8.4-r7
caddy-src< 2.8.4-r7
cadvisor< 0.51.0-r2
cadvisor-compat< 0.51.0-r2
cadvisor-fips< 0.50.0-r3
calico-3.29< 3.29.1-r2
calico-apiserver-3.29< 3.29.1-r2
calico-apiserver-compat-3.29< 3.29.1-r2
calico-apiserver-fips-3.29< 3.29.1-r2
calico-app-policy-3.29< 3.29.1-r2
calico-app-policy-fips-3.29< 3.29.1-r2
calico-cni-3.29< 3.29.1-r2
calico-cni-compat-3.29< 3.29.1-r2
calico-cni-compat-fips-3.29< 3.29.1-r2
calico-cni-fips-3.29< 3.29.1-r2
calico-felix-3.29< 3.29.1-r2
calico-felix-fips-3.29< 3.29.1-r2
calico-fips-3.29< 3.29.1-r2
calico-key-cert-provisioner-3.29< 3.29.1-r2
calico-key-cert-provisioner-fips-3.29< 3.29.1-r2
calico-kube-controllers-3.29< 3.29.1-r2
calico-kube-controllers-fips-3.29< 3.29.1-r2
calico-node-3.29< 3.29.1-r2
calico-node-fips-3.29< 3.29.1-r2
calico-pod2daemon-3.29< 3.29.1-r2
calico-pod2daemon-fips-3.29< 3.29.1-r2
calico-pod2daemon-flexvol-compat-3.29< 3.29.1-r2
calico-typha-client-3.29< 3.29.1-r2
calico-typha-client-fips-3.29< 3.29.1-r2
calico-typhad-3.29< 3.29.1-r2
calico-typhad-fips-3.29< 3.29.1-r2
calicoctl-3.29< 3.29.1-r2
calicoctl-fips-3.29< 3.29.1-r2
cass-operator< 1.23.0-r1
cass-operator-compat< 1.23.0-r1
cass-operator-compat-fips< 1.23.0-r1
cass-operator-config< 1.23.0-r1
cass-operator-fips< 1.23.0-r1
cass-operator-fips-no-pvc-delete< 1.23.0-r1
cass-operator-fips-no-pvc-delete-compat< 1.23.0-r1
cert-exporter< 2.14.0-r2
cert-exporter-fips< 2.14.0-r2
cert-manager-cmctl< 2.1.1-r3
cert-manager-cmctl-fips< 2.1.1-r3
cert-manager-istio-csr< 0.13.0-r2
cert-manager-istio-csr-compat< 0.13.0-r2
cert-manager-webhook-pdns< 2.5.1-r9
cert-manager-webhook-pdns-fips< 2.5.1-r11
certificate-transparency< 1.3.0-r3
certificate-transparency-fips< 1.3.0-r2
certificate-transparency-fips-trillian-ctserver< 1.3.0-r2
certificate-transparency-trillian-ctserver< 1.3.0-r3
cfssl< 1.6.5-r13
cfssl-bundle< 1.6.5-r13
cfssl-bundle-fips< 1.6.5-r5
cfssl-certinfo< 1.6.5-r13
cfssl-certinfo-fips< 1.6.5-r5
cfssl-fips< 1.6.5-r5
cfssl-json< 1.6.5-r13
cfssl-json-fips< 1.6.5-r5
cfssl-mkbundle< 1.6.5-r13
cfssl-mkbundle-fips< 1.6.5-r5
cfssl-multirootca< 1.6.5-r13
cfssl-multirootca-fips< 1.6.5-r5
cfssl-newkey< 1.6.5-r13
cfssl-newkey-fips< 1.6.5-r5
cfssl-scan< 1.6.5-r13
cfssl-scan-fips< 1.6.5-r5
chainctl< 0.2.20-r0
chartmuseum< 0.16.2-r9
chartmuseum-fips< 0.16.2-r7
chezmoi< 2.56.0-r2
cilium-1.15< 1.15.19-r3 | < 1.15.12-r2
cilium-1.15-clustermesh-apiserver< 1.15.12-r2
cilium-1.15-container-init< 1.15.12-r2
cilium-1.15-container-init-compat< 1.15.12-r2
cilium-1.15-hubble-relay< 1.15.12-r2
cilium-1.15-iptables< 1.15.12-r2
cilium-1.15-operator-aws< 1.15.12-r2
cilium-1.15-operator-generic< 1.15.12-r2
cilium-1.16< 1.16.5-r2
cilium-1.16-clustermesh-apiserver< 1.16.5-r2
cilium-1.16-container-init< 1.16.5-r2
cilium-1.16-container-init-compat< 1.16.5-r2

Show all 198

Alpine2 products

rclone< 1.69.0-r0
yq-go< 4.45.1-r0

2 vendors · 200 products · Showing 200 of 2639

References

25 links

go.dev/cl/637536REPORTWEBFIX
go.dev/issue/70906REPORTWEB
groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJREPORTWEB
pkg.go.dev/vuln/GO-2024-3333REPORTWEB
security.netapp.com/advisory/ntap-20250221-0001/
advisories.mageia.org/MGASA-2026-0190.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=34019REPORT
github.com/advisories/GHSA-w32m-9786-jp63Advisory
ubuntu.com/security/CVE-2024-45338REPORT
www.cve.org/CVERecord?id=CVE-2024-45338REPORT

Show all 25 references

go-review.googlesource.com/c/net/+/637536REPORT
ubuntu.com/security/notices/USN-7197-1Advisory
ubuntu.com/security/notices/USN-8900-1Advisory
security-tracker.debian.org/tracker/CVE-2024-45338Advisory
nvd.nist.gov/vuln/detail/CVE-2024-45338AdvisoryOval
github.com/golang/go/issues/70906WEB
cs.opensource.google/go/x/netPACKAGE
www.suse.com/security/cve/CVE-2024-45338WEB
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2024-45338Advisory