CVE-2024-45338

Aliases:GHSA-w32m-9786-jp63GO-2024-3333
Advisory lineage Upstream: 0 Downstream: 37
Deferred
Published: 18 Dec 2024, 20:38
Last modified:21 Feb 2025, 18:03

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.04% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Dec 2024, 20:38
Published
Vulnerability first disclosed
21 Feb 2025, 18:03
Last Modified
Vulnerability information updated

Description

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.04%• Percentile: 13%

Techniques & Countermeasures

  • CWE-1333•Inefficient Regular Expression Complexity

    The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected Systems

  • golang.org/x•net

    < 0.33.0

  • golang.org/x/net•html

    < 0.33.0

  • golang.org/x/net•golang.org/x/net/html

    < 0.33.0

References (8)