CVE-2024-45338 — Non-linear parsing of case-insensitive content in golang.org/x/net/html

Affected: golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

USN-7197-1 — golang-golang-x-net vulnerability

Affected: Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:16.04:LTS: juju-core, Ubuntu:Pro:18.04:LTS: golang-golang-x-net-dev, Ubuntu:20.04:LTS: adsys, Ubuntu:Pro:20.04:LTS: golang-golang-x-net-dev, Ubuntu:22.04:LTS: adsys, Ubuntu:Pro:22.04:LTS: golang-golang-x-net, Ubuntu:24.04:LTS: adsys, Ubuntu:Pro:24.04:LTS: golang-golang-x-net

Guido Vranken discovered that Go Networking handled input to the Parse functions inefficiently. An attacker could possibly use this issue to cause denial of service. This update addresses the issue in the golang-golang-x-net and golang-golang-x-net-dev packages, as well as the library vendored within adsys and juju-core.

Most recent entries from all

CVE-2024-45338 — Non-linear parsing of case-insensitive content in golang.org/x/net/html

USN-7197-1 — golang-golang-x-net vulnerability