CVE-2024-45338
Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
CVE-2024-45338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2024-3617
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
EUVD-2024-3617- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w32m-9786-jp63
Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
GHSA-w32m-9786-jp63- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
CVE-2024-45338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-45338
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
ALPINE-CVE-2024-45338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
OSVDEBIAN-CVE-2024-45338
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
DEBIAN-CVE-2024-45338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 48 moreShow less
OSVGHSA-w32m-9786-jp63
Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
GHSA-w32m-9786-jp63- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-45338
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
UBUNTU-CVE-2024-45338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-54398 No score
CVE-2024-45338 affecting package prometheus-adapter for versions less than 0.12.0-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54398- Updated
- 2026-11-05
OSVAZL-54401 No score
CVE-2024-45338 affecting package packer for versions less than 1.9.5-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54401- Updated
- 2026-11-02
OSVAZL-54404 No score
CVE-2024-45338 affecting package docker-buildx for versions less than 0.14.0-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54404- Updated
- 2026-11-05
OSVAZL-54407 No score
CVE-2024-45338 affecting package keda for versions less than 2.14.1-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54407- Updated
- 2026-11-02
OSVAZL-54410 No score
CVE-2024-45338 affecting package node-problem-detector for versions less than 0.8.15-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54410- Updated
- 2026-11-02
OSVAZL-54413 No score
CVE-2024-45338 affecting package helm for versions less than 3.15.2-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54413- Updated
- 2026-11-02
OSVAZL-54419 No score
CVE-2024-45338 affecting package gh for versions less than 2.62.0-5
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54419- Updated
- 2026-11-02
OSVAZL-54422 No score
CVE-2024-45338 affecting package telegraf for versions less than 1.31.0-4
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54422- Updated
- 2026-11-02
OSVAZL-54425 No score
CVE-2024-45338 affecting package kubernetes for versions less than 1.30.3-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54425- Updated
- 2026-11-05
OSVAZL-54428 No score
CVE-2024-45338 affecting package cert-manager for versions less than 1.12.15-1
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54428- Updated
- 2026-11-05
OSVAZL-54431 No score
CVE-2024-45338 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.2-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54431- Updated
- 2026-11-02
OSVAZL-54434 No score
CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54434- Updated
- 2026-11-02
OSVAZL-54437 No score
CVE-2024-45338 affecting package influxdb for versions less than 2.7.3-9
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54437- Updated
- 2026-11-02
OSVAZL-54440 No score
CVE-2024-45338 affecting package containerized-data-importer for versions less than 1.57.0-8
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54440- Updated
- 2026-11-02
OSVAZL-54443 No score
CVE-2024-45338 affecting package kubevirt for versions less than 1.2.0-12
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54443- Updated
- 2026-11-02
OSVAZL-54446 No score
CVE-2024-45338 affecting package docker-compose for versions less than 2.27.0-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54446- Updated
- 2026-11-02
OSVAZL-54449 No score
CVE-2024-45338 affecting package ig for versions less than 0.32.0-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54449- Updated
- 2026-11-02
OSVAZL-54452 No score
CVE-2024-45338 affecting package multus for versions less than 4.0.2-4
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54452- Updated
- 2026-11-05
OSVAZL-54461 No score
CVE-2024-45338 affecting package cri-tools for versions less than 1.32.0-1
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54461- Updated
- 2026-11-05
OSVAZL-54464 No score
CVE-2024-45338 affecting package sriov-network-device-plugin for versions less than 3.7.0-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54464- Updated
- 2026-11-02
OSVAZL-54467 No score
CVE-2024-45338 affecting package cni for versions less than 1.1.2-4
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54467- Updated
- 2026-11-05
OSVAZL-54470 No score
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54470- Updated
- 2026-11-05
OSVAZL-54473 No score
CVE-2024-45338 affecting package cf-cli for versions less than 8.7.3-5
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54473- Updated
- 2026-11-05
OSVAZL-54477 No score
CVE-2024-45338 affecting package buildah 1.18.0-29
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54477- Updated
- 2026-11-02
OSVAZL-54480 No score
CVE-2024-45338 affecting package containernetworking-plugins 1.1.1-17
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54480- Updated
- 2026-11-02
OSVAZL-54483 No score
CVE-2024-45338 affecting package podman 4.1.1-26
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54483- Updated
- 2026-11-02
OSVAZL-54485 No score
CVE-2024-45338 affecting package buildah for versions less than 1.41.4-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54485- Updated
- 2026-11-02
OSVAZL-54488 No score
CVE-2024-45338 affecting package podman for versions less than 5.6.1-2
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54488- Updated
- 2026-11-02
OSVAZL-54491 No score
CVE-2024-45338 affecting package cri-o 1.30.1-1
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54491- Updated
- 2026-11-05
OSVAZL-54498 No score
CVE-2024-45338 affecting package cert-manager for versions less than 1.11.2-17
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54498- Updated
- 2026-11-02
OSVAZL-54500 No score
CVE-2024-45338 affecting package kubernetes for versions less than 1.28.4-14
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54500- Updated
- 2026-11-02
OSVAZL-54507 No score
CVE-2024-45338 affecting package vitess for versions less than 17.0.7-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54507- Updated
- 2026-11-02
OSVAZL-54510 No score
CVE-2024-45338 affecting package packer for versions less than 1.9.5-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54510- Updated
- 2026-11-02
OSVAZL-54512 No score
CVE-2024-45338 affecting package cri-tools for versions less than 1.29.0-6
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54512- Updated
- 2026-11-02
OSVAZL-54515 No score
CVE-2024-45338 affecting package terraform for versions less than 1.3.2-21
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54515- Updated
- 2026-11-02
OSVAZL-54519 No score
CVE-2024-45338 affecting package sriov-network-device-plugin for versions less than 3.6.2-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54519- Updated
- 2026-11-02
OSVAZL-54522 No score
CVE-2024-45338 affecting package prometheus-adapter for versions less than 0.10.0-16
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54522- Updated
- 2026-11-02
OSVAZL-54524 No score
CVE-2024-45338 affecting package influxdb for versions less than 2.6.1-19
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54524- Updated
- 2026-11-02
OSVAZL-54527 No score
CVE-2024-45338 affecting package containerized-data-importer for versions less than 1.55.0-22
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54527- Updated
- 2026-11-02
OSVAZL-54531 No score
CVE-2024-45338 affecting package kubevirt for versions less than 0.59.0-23
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54531- Updated
- 2026-11-02
OSVAZL-54534 No score
CVE-2024-45338 affecting package helm for versions less than 3.14.2-5
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54534- Updated
- 2026-11-02
OSVAZL-54540 No score
CVE-2024-45338 affecting package gh for versions less than 2.13.0-24
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54540- Updated
- 2026-11-02
OSVAZL-54542 No score
CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54542- Updated
- 2026-11-02
OSVAZL-54546 No score
CVE-2024-45338 affecting package containerd2 for versions less than 2.0.0-3
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54546- Updated
- 2026-11-02
OSVAZL-54549 No score
CVE-2024-45338 affecting package cf-cli for versions less than 8.4.0-23
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54549- Updated
- 2026-11-02
OSVAZL-54555 No score
CVE-2024-45338 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-24
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
- Record
AZL-54555- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang.org/x/net/htmlGo |
before 0.33.0 | 0.33.0 |
rcloneAlpine:v3.22 |
before 1.69.0-r0 | 1.69.0-r0 |
rcloneAlpine:v3.23 |
before 1.69.0-r0 | 1.69.0-r0 |
rcloneAlpine:v3.24 |
before 1.69.0-r0 | 1.69.0-r0 |
yq-goAlpine:v3.22 |
before 4.45.1-r0 | 4.45.1-r0 |
yq-goAlpine:v3.23 |
before 4.45.1-r0 | 4.45.1-r0 |
yq-goAlpine:v3.24 |
before 4.45.1-r0 | 4.45.1-r0 |
prometheus-adapterAzure Linux:3 |
before 0.12.0-2 | 0.12.0-2 |
packerAzure Linux:3 |
before 1.9.5-7 | 1.9.5-7 |
docker-buildxAzure Linux:3 |
before 0.14.0-3 | 0.14.0-3 |
Show 129 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kedaAzure Linux:3 |
before 2.14.1-2 | 2.14.1-2 |
node-problem-detectorAzure Linux:3 |
before 0.8.15-3 | 0.8.15-3 |
helmAzure Linux:3 |
before 3.15.2-2 | 3.15.2-2 |
ghAzure Linux:3 |
before 2.62.0-5 | 2.62.0-5 |
telegrafAzure Linux:3 |
before 1.31.0-4 | 1.31.0-4 |
kubernetesAzure Linux:3 |
before 1.30.3-2 | 1.30.3-2 |
cert-managerAzure Linux:3 |
before 1.12.15-1 | 1.12.15-1 |
application-gateway-kubernetes-ingressAzure Linux:3 |
before 1.7.2-3 | 1.7.2-3 |
kube-vip-cloud-providerAzure Linux:3 |
before 0.0.10-3 | 0.0.10-3 |
influxdbAzure Linux:3 |
before 2.7.3-9 | 2.7.3-9 |
containerized-data-importerAzure Linux:3 |
before 1.57.0-8 | 1.57.0-8 |
kubevirtAzure Linux:3 |
before 1.2.0-12 | 1.2.0-12 |
docker-composeAzure Linux:3 |
before 2.27.0-3 | 2.27.0-3 |
igAzure Linux:3 |
before 0.32.0-3 | 0.32.0-3 |
multusAzure Linux:3 |
before 4.0.2-4 | 4.0.2-4 |
cri-toolsAzure Linux:3 |
before 1.32.0-1 | 1.32.0-1 |
sriov-network-device-pluginAzure Linux:3 |
before 3.7.0-2 | 3.7.0-2 |
cniAzure Linux:3 |
before 1.1.2-4 | 1.1.2-4 |
cni-pluginsAzure Linux:3 |
before 1.4.0-2 | 1.4.0-2 |
cf-cliAzure Linux:3 |
before 8.7.3-5 | 8.7.3-5 |
buildahAzure Linux:2 |
through 1.18.0-29 | None known |
containernetworking-pluginsAzure Linux:2 |
through 1.1.1-17 | None known |
podmanAzure Linux:2 |
through 4.1.1-26 | None known |
buildahAzure Linux:3 |
before 1.41.4-2 | 1.41.4-2 |
podmanAzure Linux:3 |
before 5.6.1-2 | 5.6.1-2 |
cri-oAzure Linux:3 |
through 1.30.1-1 | None known |
cert-managerAzure Linux:2 |
before 1.11.2-17 | 1.11.2-17 |
kubernetesAzure Linux:2 |
before 1.28.4-14 | 1.28.4-14 |
vitessAzure Linux:2 |
before 17.0.7-3 | 17.0.7-3 |
packerAzure Linux:2 |
before 1.9.5-7 | 1.9.5-7 |
cri-toolsAzure Linux:2 |
before 1.29.0-6 | 1.29.0-6 |
terraformAzure Linux:2 |
before 1.3.2-21 | 1.3.2-21 |
sriov-network-device-pluginAzure Linux:2 |
before 3.6.2-7 | 3.6.2-7 |
prometheus-adapterAzure Linux:2 |
before 0.10.0-16 | 0.10.0-16 |
influxdbAzure Linux:2 |
before 2.6.1-19 | 2.6.1-19 |
containerized-data-importerAzure Linux:2 |
before 1.55.0-22 | 1.55.0-22 |
kubevirtAzure Linux:2 |
before 0.59.0-23 | 0.59.0-23 |
helmAzure Linux:2 |
before 3.14.2-5 | 3.14.2-5 |
ghAzure Linux:2 |
before 2.13.0-24 | 2.13.0-24 |
cni-pluginsAzure Linux:2 |
before 1.3.0-7 | 1.3.0-7 |
containerd2Azure Linux:3 |
before 2.0.0-3 | 2.0.0-3 |
cf-cliAzure Linux:2 |
before 8.4.0-23 | 8.4.0-23 |
application-gateway-kubernetes-ingressAzure Linux:2 |
before 1.4.0-24 | 1.4.0-24 |
telegrafAzure Linux:2 |
before 1.29.4-10 | 1.29.4-10 |
kedaAzure Linux:2 |
before 2.4.0-25 | 2.4.0-25 |
multusAzure Linux:2 |
before 4.0.2-7 | 4.0.2-7 |
cri-oAzure Linux:2 |
before 1.22.3-9 | 1.22.3-9 |
daselAzure Linux:3 |
before 2.8.1-2 | 2.8.1-2 |
cniAzure Linux:2 |
before 1.0.1-20 | 1.0.1-20 |
golang-golang-x-netDebian:12 |
All versions, plus listed versions 1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2 Show 25 moreShow less1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-11:0.61.0-11:0.62.0-11:0.7.0+dfsg-1 |
None known |
golang-golang-x-netDebian:13 |
before 1:0.27.0-2 | 1:0.27.0-2 |
golang-golang-x-netDebian:14 |
before 1:0.27.0-2 | 1:0.27.0-2 |
golang.org/x/netGo |
before 0.33.0 | 0.33.0 |
rcloneMageia:9 From an advisory covering 31 CVEs |
before 1.73.5-1.1.mga9 | 1.73.5-1.1.mga9 |
golang-x-netMageia:9 |
before 0.7.0-2.1.mga9 | 0.7.0-2.1.mga9 |
golang.org/x/netRoot:Go |
before v0.26.0-aikido.2 | v0.26.0-aikido.2v0.29.0-aikido.1v0.23.0-aikido.1v0.29.0-aikido.2v0.29.0-aikido.3v0.29.0-aikido.4v0.29.0-aikido.5v0.23.0-aikido.2v0.23.0-aikido.3v0.29.0-aikido.6 |
rootio-golang.org/x/netRoot:Go |
before v0.26.0-root.io.2 | v0.26.0-root.io.2v0.29.0-root.io.1v0.23.0-root.io.1v0.29.0-root.io.2v0.29.0-root.io.3v0.29.0-root.io.4v0.29.0-root.io.5v0.23.0-root.io.2v0.23.0-root.io.3v0.29.0-root.io.6 |
govulncheck-vulndbSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 18 CVEs |
before 0.0.20250108T191942-150000.1.26.1 | 0.0.20250108T191942-150000.1.26.1 |
govulncheck-vulndbopenSUSE:Leap 15.6 From an advisory covering 18 CVEs |
before 0.0.20250108T191942-150000.1.26.1 | 0.0.20250108T191942-150000.1.26.1 |
kubevirtSUSE:Linux Enterprise Module for Containers 15 SP7 From an advisory covering 2 CVEs |
before 1.5.2-150700.3.5.2 | 1.5.2-150700.3.5.2 |
kubevirtSUSE:Linux Enterprise Module for Containers 15 SP6 From an advisory covering 3 CVEs |
before 1.4.1-150600.5.24.1 | 1.4.1-150600.5.24.1 |
kubevirtopenSUSE:Leap 15.6 From an advisory covering 3 CVEs |
before 1.4.1-150600.5.24.1 | 1.4.1-150600.5.24.1 |
helmSUSE:Linux Enterprise Micro 5.5 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Module for Containers 15 SP6 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
helmopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 3.17.1-150000.1.41.1 | 3.17.1-150000.1.41.1 |
apptainerSUSE:Linux Enterprise Module for HPC 15 SP6 From an advisory covering 6 CVEs |
before 1.3.6-150600.4.9.1 | 1.3.6-150600.4.9.1 |
apptaineropenSUSE:Leap 15.6 From an advisory covering 6 CVEs |
before 1.3.6-150600.4.9.1 | 1.3.6-150600.4.9.1 |
helmSUSE:Linux Micro 6.0 From an advisory covering 5 CVEs |
before 3.17.2-1.1 | 3.17.2-1.1 |
helmSUSE:Linux Micro 6.1 From an advisory covering 5 CVEs |
before 3.17.2-slfo.1.1_1.1 | 3.17.2-slfo.1.1_1.1 |
golang-golang-x-net-devUbuntu:Pro:16.04:LTS |
before 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1, plus listed versions 0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-1 |
1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1 |
juju-coreUbuntu:Pro:16.04:LTS |
before 2.3.7-0ubuntu0.16.04.1+esm1, plus listed versions 1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2 Show 10 moreShow less2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.12.0.2-0ubuntu0.16.04.22.3.1-0ubuntu0.16.04.12.3.2-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.1 |
2.3.7-0ubuntu0.16.04.1+esm1 |
golang-golang-x-net-devUbuntu:Pro:18.04:LTS |
before 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1, plus listed versions 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-2 |
1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1 |
adsysUbuntu:20.04:LTS |
before 0.9.2~20.04.2ubuntu0.1, plus listed versions 0.8~22.040.9.2~20.040.9.2~20.04.10.9.2~20.04.2 |
0.9.2~20.04.2ubuntu0.1 |
golang-golang-x-net-devUbuntu:Pro:20.04:LTS |
before 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1, plus listed versions 1:0.0+git20190811.74dc4d7+dfsg-1 |
1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1 |
adsysUbuntu:22.04:LTS |
before 0.14.3~22.04ubuntu0.1, plus listed versions 0.7.10.7.1build10.80.8ubuntu10.8.1 Show 11 moreShow less0.8.20.8.30.8.40.8.5~22.040.9.2~22.040.9.2~22.04.10.9.2~22.04.20.14.1~22.040.14.2~22.040.14.2~22.04ubuntu0.10.14.3~22.04 |
0.14.3~22.04ubuntu0.1 |
golang-golang-x-netUbuntu:22.04:LTS |
before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1, plus listed versions 1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-1 |
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 |
golang-golang-x-netUbuntu:Pro:22.04:LTS |
before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1, plus listed versions 1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-1 |
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1 |
adsysUbuntu:24.04:LTS |
before 0.14.3~24.04ubuntu0.1, plus listed versions 0.13.10.13.20.13.30.14.10.14.1build1 Show 4 moreShow less0.14.1ubuntu0.24.04.10.14.2~24.040.14.2~24.04ubuntu0.10.14.3~24.04 |
0.14.3~24.04ubuntu0.1 |
golang-golang-x-netUbuntu:Pro:24.04:LTS |
before 1:0.21.0+dfsg-1ubuntu0.1~esm1, plus listed versions 1:0.10.0-11:0.17.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-1 |
1:0.21.0+dfsg-1ubuntu0.1~esm1 |
golang-golang-x-netUbuntu:25.10 |
All versions, plus listed versions 1:0.27.0-11:0.27.0-2 |
None known |
golang-golang-x-netUbuntu:26.10 |
All versions, plus listed versions 1:0.27.0-21:0.57.0-11:0.58.0-1 |
None known |
golang-golang-x-netUbuntu:26.04:LTS |
All versions, plus listed versions 1:0.27.0-2 |
None known |
golang-golang-x-netUbuntu:22.04:LTS From an advisory covering 8 CVEs |
before 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1, plus listed versions 1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-1 |
1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 0.0.20241218T202206-1.1 | 0.0.20241218T202206-1.1 |
teleportopenSUSE:Tumbleweed |
before 17.1.0-1.1 | 17.1.0-1.1 |
trivySUSE:Package Hub 15 SP6 From an advisory covering 8 CVEs |
before 0.58.2-bp156.2.6.1 | 0.58.2-bp156.2.6.1 |
trivyopenSUSE:Leap 15.6 From an advisory covering 8 CVEs |
before 0.58.2-bp156.2.6.1 | 0.58.2-bp156.2.6.1 |
gitea-teaSUSE:Package Hub 15 SP6 From an advisory covering 3 CVEs |
before 0.9.2-bp156.5.1 | 0.9.2-bp156.5.1 |
gitea-teaopenSUSE:Leap 15.6 From an advisory covering 3 CVEs |
before 0.9.2-bp156.5.1 | 0.9.2-bp156.5.1 |
sopsopenSUSE:Tumbleweed |
before 3.9.3-1.1 | 3.9.3-1.1 |
veleroopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.15.1-1.1 | 1.15.1-1.1 |
operator-sdkopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.39.0-1.1 | 1.39.0-1.1 |
yqopenSUSE:Tumbleweed |
before 4.44.6-1.1 | 4.44.6-1.1 |
kepleropenSUSE:Tumbleweed |
before 0.7.11-2.1 | 0.7.11-2.1 |
rcloneopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.69.0-1.1 | 1.69.0-1.1 |
velociraptoropenSUSE:Tumbleweed From an advisory covering 27 CVEs |
before 0.7.0.4.git142.862ef23-1.1 | 0.7.0.4.git142.862ef23-1.1 |
helmfileopenSUSE:Tumbleweed |
before 0.170.0-1.1 | 0.170.0-1.1 |
hauleropenSUSE:Tumbleweed |
before 1.1.1-2.1 | 1.1.1-2.1 |
trivyopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.58.2-1.1 | 0.58.2-1.1 |
kubeloginopenSUSE:Tumbleweed |
before 0.1.7-1.1 | 0.1.7-1.1 |
helmopenSUSE:Tumbleweed |
before 3.17.0-2.1 | 3.17.0-2.1 |
kuredopenSUSE:Tumbleweed |
before 1.17.1-1.1 | 1.17.1-1.1 |
apptaineropenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.3.6-5.1 | 1.3.6-5.1 |
traefikopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 3.4.3-1.1 | 3.4.3-1.1 |
traefik2openSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 2.11.26-1.1 | 2.11.26-1.1 |
helm3openSUSE:Tumbleweed From an advisory covering 20 CVEs |
before 3.19.2-1.1 | 3.19.2-1.1 |
helmfileopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 1.1.9-bp160.1.1 | 1.1.9-bp160.1.1 |
hauleropenSUSE:Leap 16.0 From an advisory covering 8 CVEs |
before 1.3.1-bp160.1.1 | 1.3.1-bp160.1.1 |
luxopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 0.24.1-1.1 | 0.24.1-1.1 |
kubesealopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.41.1-1.1 | 0.41.1-1.1 |
kumactlopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.0.0-1.1 | 3.0.0-1.1 |
timoniopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 0.36.0-1.1 | 0.36.0-1.1 |
containerized-data-importeropenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 1.64.0-160000.1.1 | 1.64.0-160000.1.1 |
luxopenSUSE:Leap 16.0 From an advisory covering 9 CVEs |
before 0.24.1-bp160.1.1 | 0.24.1-bp160.1.1 |
gitea-teaopenSUSE:Leap 16.0 From an advisory covering 7 CVEs |
before 0.15.1-bp160.1.1 | 0.15.1-bp160.1.1 |
glabopenSUSE:Leap 16.0 From an advisory covering 24 CVEs |
before 1.114.0-bp160.1.1 | 1.114.0-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected, aliases, aliases_more, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45338 is a medium vulnerability (CVSS 5.3) in Golang.org/x/net Golang.org/x/net/html, published December 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. Fixed in golang.org/x/net/html 0.33.0.
References
go.dev/cl/637536
groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
pkg.go.dev/vuln/GO-2024-3333
security.netapp.com/advisory/ntap-20250221-0001
nvd.nist.gov/vuln/detail/CVE-2024-45338
Show 194 moreShow less
github.com/golang/go/issues/70906
security.alpinelinux.org/vuln/CVE-2024-45338
security-tracker.debian.org/tracker/CVE-2024-45338
cs.opensource.google/go/x/net
advisories.mageia.org/MGASA-2026-0147.html
bugs.mageia.org/show_bug.cgi?id=33808
rclone.org/changelog
suse.com/support/update/announcement/2025/suse-su-20250060-1
bugzilla.suse.com/1232762
ubuntu.com/security/CVE-2024-45338
cve.org/CVERecord?id=CVE-2024-45338
go-review.googlesource.com/c/net/+/637536
lists.opensuse.org/archives/list/[email protected]/thread/GN5BTYONDVDULOG3YURKUJNL2YZ2LDHU
Left out here: 74 references. The JSON record has them. Also not on the record: 7 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 57 source records.