CVE-2024-24788 — Infinite Loop in Standard Library NET

CWE-835 — Infinite LoopCWE-1395 — Dependency on Vulnerable Third-Party Component11 documents9 sources
Severity
5.9MEDIUMNVD
EPSS
0.1%
top 64.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GO Standard Library NETGithub.com Traefik Traefik V2Github.com Traefik Traefik V3+1 more
Timeline
PublishedMay 8
Latest updateJul 9

Description

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5go_standard_library/net1.22.0-0 — 1.22.3

🔴Vulnerability Details

6
GHSA
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop↗2024-05-23
▶
OSV
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop↗2024-05-23
▶
CVEList
Malformed DNS message can cause infinite loop in net↗2024-05-08
▶
OSV
CVE-2024-24788: A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop↗2024-05-08
▶
GHSA
GHSA-2jwv-jmq4-4j3r: A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop↗2024-05-08
▶

📋Vendor Advisories

4
Ubuntu
Go vulnerabilities↗2024-07-09
▶
Microsoft
Malformed DNS message can cause infinite loop in net↗2024-05-14
▶
Red Hat
golang: net: malformed DNS message can cause infinite loop↗2024-05-08
▶
Debian
CVE-2024-24788: golang-1.15 - A malformed DNS message in response to a query can cause the Lookup functions to...↗2024
▶
CVE-2024-24788 — Infinite Loop in Standard Library NET | cvebase