CVE-2024-24790

CRITICAL

Published Jun 5, 2024 Modified Nov 21, 2024

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
golang	go	< 1.21.11
golang	go	1.22.0 — 1.22.4

References

Advisories & Patches

https://go.dev/cl/590316 https://go.dev/cl/590316

Other References

http://www.openwall.com/lists/oss-security/2024/06/04/1 https://go.dev/issue/67680 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://pkg.go.dev/vuln/GO-2024-2887 http://www.openwall.com/lists/oss-security/2024/06/04/1 https://go.dev/issue/67680 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://pkg.go.dev/vuln/GO-2024-2887 https://security.netapp.com/advisory/ntap-20240905-0002/

Frequently Asked Questions

What is CVE-2024-24790? +

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2024-24790? +

CVE-2024-24790 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-24790? +

CVE-2024-24790 affects products from golang, specifically: go. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-24790? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-4674 8.6

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration …

CVE-2026-33814 7.5

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE …

CVE-2026-42501 7.5

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database …

CVE-2026-42499 7.5

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVE-2026-33813 7.5

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

CVE-2026-39820 7.5

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.