Fluid Attacks Database

Description

Non-linear parsing of case-insensitive content in golang.org/x/net/html An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	golang.org/x/net	>=0 <0.33.0	0.33.0
go	golang.org/x/net/html	>=0 <0.33.0	0.33.0
debian 12	golang-golang-x-net	=1:0.10.0-1 \|\| =1:0.11.0-1 \|\| =1:0.14.0-1 \|\| =1:0.15.0-1 \|\| =1:0.15.0-2 \|\| =1:0.17.0+dfsg-1 \|\| =1:0.19.0+dfsg-1 \|\| =1:0.20.0+dfsg-1 \|\| =1:0.21.0+dfsg-1 \|\| =1:0.22.0+dfsg-1 \|\| =1:0.23.0+dfsg-1 \|\| =1:0.24.0+dfsg-1 \|\| =1:0.25.0+dfsg-1 \|\| =1:0.26.0+dfsg-1 \|\| =1:0.26.0+dfsg-2 \|\| =1:0.27.0-1 \|\| =1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1 \|\| =1:0.57.0-1 \|\| =1:0.58.0-1 \|\| =1:0.7.0+dfsg-1	-
debian 13	golang-golang-x-net	>=0 <1:0.27.0-2	1:0.27.0-2
debian 14	golang-golang-x-net	>=0 <1:0.27.0-2	1:0.27.0-2

Aliases

1. CVE-2024-453382. NVD-2024-453383. OSV-2024-453384. OSV-DEBIAN-2024-453385. GHSA-w32m-9786-jp636. GCVE-2024-453387. SECURITY-TRACKER-CVE-2024-45338

References

1. https://github.com/golang/go/issues/709062. https://cs.opensource.google/go/x/net3. https://go.dev/cl/6375364. https://go.dev/issue/709065. https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ6. https://pkg.go.dev/vuln/GO-2024-3333

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.