CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45338?
CVE-2024-45338 is classified as a denial-of-service vulnerability due to its potential for causing extremely slow parsing.
How do I fix CVE-2024-45338?
To mitigate CVE-2024-45338, upgrade the golang.org/x/net package to version 0.33.0 or later.
What software is affected by CVE-2024-45338?
CVE-2024-45338 affects golang.org/x/net version 0.33.0 and earlier, as well as specific versions of the debian package golang-golang-x-net.
What impact does CVE-2024-45338 have on applications?
CVE-2024-45338 can lead to denial-of-service conditions, impacting the responsiveness and availability of applications using the affected parsing functions.
Who is responsible for patching CVE-2024-45338?
Maintainers of the affected software packages are responsible for releasing patches to address CVE-2024-45338.