Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2024-24786

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Acm Ceph Storage Cluster Observability Operator and 20 more
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2024-24783

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security Ansible Automation Platform Ceph Storage and 20 more
CVE-2024-24784

Comments in display names are incorrectly handled in net/mail

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Go Standard Library Redhat
Products
Net\/mail Advanced Cluster Security Ceph Storage and 11 more
CVE-2024-24785

Errors returned from JSON marshaling may break template escaping in html/template

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ceph Storage Enterprise Linux Kube Descheduler Operator and 15 more
CVE-2023-45290

Memory exhaustion in multipart form parsing in net/textproto and net/http

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security Ansible Automation Platform Ceph Storage and 17 more
CVE-2024-24791

Denial of service due to improper 100-continue handling in net/http

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Go Standard Library Redhat
Products
Net\/http Amq Streams Ceph Storage and 17 more
CVE-2024-34155

Stack exhaustion in all Parse functions in go/parser

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ceph Storage Cost Management Cryostat and 12 more
CVE-2024-24790

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Golang Redhat
Products
Go Advanced Cluster Security Ansible Automation Platform and 17 more
CVE-2023-39325

HTTP/2 rapid reset can cause excessive work in net/http

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Http2 and 50 more