CVE-2024-24789: go — Fix

Description

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Is your site exposed to CVE-2024-24789?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
golang	go	< 1.21.11
golang	go	1.22.0 — 1.22.4

References

Advisories & Patches

https://go.dev/cl/585397 https://go.dev/issue/66869 https://go.dev/cl/585397 https://go.dev/issue/66869

Other References

http://www.openwall.com/lists/oss-security/2024/06/04/1 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ https://pkg.go.dev/vuln/GO-2024-2888 http://www.openwall.com/lists/oss-security/2024/06/04/1 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ https://pkg.go.dev/vuln/GO-2024-2888 https://security.netapp.com/advisory/ntap-20250131-0008/

Frequently Asked Questions

What is CVE-2024-24789? +

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-24789? +

CVE-2024-24789 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-24789? +

CVE-2024-24789 affects products from golang, specifically: go. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-24789? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-46595 10.0

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other …

CVE-2024-24790 9.8

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses …

CVE-2026-39834 9.1

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the …

CVE-2026-39832 9.1

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination …

CVE-2026-42508 9.1

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' …

CVE-2026-39833 9.1

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would …

CVE-2024-24789