GHSA-7h65-4p22-39j6
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.
Critical Vulnerabilities
Vulnerability: CVE-2024-24790, golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Affected versions: 1.17.1,1.16.2,1.15.5
See screenshot for more details
Fixed versions: 1.17.2,1.16.3,1.15.6
Release notes:
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.
Critical Vulnerabilities
Vulnerability: CVE-2024-24790, golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Affected versions: 1.17.1,1.16.2,1.15.5
See screenshot for more details
Fixed versions: 1.17.2,1.16.3,1.15.6
Release notes:
- Record
GHSA-7h65-4p22-39j6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.
Critical Vulnerabilities
Vulnerability: CVE-2024-24790, golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Affected versions: 1.17.1,1.16.2,1.15.5
See screenshot for more details
Fixed versions: 1.17.2,1.16.3,1.15.6
Release notes:
- Record
GHSA-7h65-4p22-39j6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGO-2024-3219No score
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
- Record
GO-2024-3219- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/crossplane/crossplaneGo | 1.15.5 to 1.15.5 | 1.15.6 |
github.com/crossplane/crossplaneGo | 1.16.2 to 1.16.2 | 1.16.3 |
github.com/crossplane/crossplaneGo | 1.17.1 to 1.17.1 | 1.17.2 |
github.com/crossplane/crossplaneGo | 1.15.5 up to 1.15.6 | 1.15.6 |
github.com/crossplane/crossplaneGo | 1.16.2 up to 1.16.3 | 1.16.3 |
github.com/crossplane/crossplaneGo | 1.17.1 up to 1.17.2 | 1.17.2 |
github.com/crossplane/crossplaneGo | 1.15.5 up to 1.15.6, 1.16.2 up to 1.16.3, 1.17.1 up to 1.17.2 | 1.15.61.16.31.17.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-7h65-4p22-39j6 is a critical vulnerability (CVSS 9.8) in github.com/crossplane/crossplane, published October 25, 2024. No source lists public exploit code. Fixed in github.com/crossplane/crossplane 1.15.6.