CVE catalog
CVE-2024-45338
Go Networking vulnerability
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.07% · Oct 25, 2026
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-golang-x-net | sid | 1:0.61.0-1 | fixed |
| Debian | golang-golang-x-net | forky | 1:0.61.0-1 | fixed |
| Debian | golang-golang-x-net | trixie | 1:0.27.0-2 | fixed |
| Debian | golang-golang-x-net | bookworm | 1:0.7.0+dfsg-1 | vulnerable |
| Ubuntu | golang-golang-x-net | noble | Not reported | vulnerable |
| Ubuntu | adsys | noble | 0.14.3~24.04ubuntu0.1 | fixed |
| Ubuntu | golang-golang-x-net | noble | 1:0.21.0+dfsg-1ubuntu0.1~esm1 | fixed |
| Ubuntu | adsys-windows | noble | 0.14.3~24.04ubuntu0.1 | fixed |
| Ubuntu | golang-golang-x-net-dev | noble | 1:0.21.0+dfsg-1ubuntu0.1~esm1 | fixed |
| Go | golang.org/x/net | Not reported | 0.33.0 | fixed |
| Opensuse | glab | leap 16.0 | 1.114.0-bp160.1.1 | fixed |
| Opensuse | lux | leap 16.0 | 0.24.1-bp160.1.1 | fixed |
| Opensuse | lux | tumbleweed | 0.24.1-1.1 | fixed |
| Ubuntu | golang-golang-x-net-dev | pro | 1:0.0+git20190811.74dc4d7+dfsg-1 | vulnerable |
| Ubuntu | golang-golang-x-net-dev | pro | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1 | fixed |
| Ubuntu | juju-core | pro | 1.24.6-0ubuntu3 | vulnerable |
| Ubuntu | juju-core | pro | 1.25.0-0ubuntu1 | vulnerable |
| Ubuntu | juju-core | pro | 1.25.0-0ubuntu2 | vulnerable |
| Ubuntu | juju-core | pro | 1.25.0-0ubuntu3 | vulnerable |
| Ubuntu | juju-core | pro | 2.0~beta4-0ubuntu2 | vulnerable |
| Ubuntu | juju-core | pro | 2.0~beta6-0ubuntu1.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.0~beta7-0ubuntu1.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.0~beta12-0ubuntu1.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.0~beta15-0ubuntu2.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.0.0-0ubuntu0.16.04.2 | vulnerable |
| Ubuntu | juju-core | pro | 2.0.2-0ubuntu0.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.0.2-0ubuntu0.16.04.2 | vulnerable |
| Ubuntu | juju-core | pro | 2.3.1-0ubuntu0.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.3.2-0ubuntu0.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.3.7-0ubuntu0.16.04.1 | vulnerable |
| Ubuntu | juju-core | pro | 2.3.7-0ubuntu0.16.04.1+esm1 | fixed |
| Ubuntu | adsys | 20.04 | 0.8~22.04 | vulnerable |
| Ubuntu | adsys | 20.04 | 0.9.2~20.04 | vulnerable |
| Ubuntu | adsys | 20.04 | 0.9.2~20.04.1 | vulnerable |
| Ubuntu | adsys | 20.04 | 0.9.2~20.04.2 | vulnerable |
| Ubuntu | adsys | 20.04 | 0.9.2~20.04.2ubuntu0.1 | fixed |
| Ubuntu | adsys | 22.04 | 0.7.1 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.7.1build1 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8ubuntu1 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8.1 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8.2 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8.3 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8.4 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.8.5~22.04 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.9.2~22.04 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.9.2~22.04.1 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.9.2~22.04.2 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.14.1~22.04 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.14.2~22.04 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.14.2~22.04ubuntu0.1 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.14.3~22.04 | vulnerable |
| Ubuntu | adsys | 22.04 | 0.14.3~22.04ubuntu0.1 | fixed |
| Ubuntu | golang-golang-x-net | pro | 1:0.10.0-1 | vulnerable |
| Ubuntu | golang-golang-x-net | pro | 1:0.17.0+dfsg-1 | vulnerable |
| Ubuntu | golang-golang-x-net | pro | 1:0.20.0+dfsg-1 | vulnerable |
| Ubuntu | golang-golang-x-net | pro | 1:0.21.0+dfsg-1 | vulnerable |
| Ubuntu | golang-golang-x-net | pro | 1:0.21.0+dfsg-1ubuntu0.1~esm1 | fixed |
| Ubuntu | adsys | 24.04 | 0.13.1 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.13.2 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.13.3 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.1 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.1build1 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.1ubuntu0.24.04.1 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.2~24.04 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.2~24.04ubuntu0.1 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.3~24.04 | vulnerable |
| Ubuntu | adsys | 24.04 | 0.14.3~24.04ubuntu0.1 | fixed |
| Opensuse | hauler | leap 16.0 | 1.3.1-bp160.1.1 | fixed |
| Opensuse | helmfile | leap 16.0 | 1.1.9-bp160.1.1 | fixed |
| Opensuse | traefik | tumbleweed | 3.4.3-1.1 | fixed |
| Suse | govulncheck-vulndb | linux enterprise module for package hub 15 sp6 | 0.0.20250108T191942-150000.1.26.1 | fixed |
| Opensuse | govulncheck-vulndb | leap 15.6 | 0.0.20250108T191942-150000.1.26.1 | fixed |
| Opensuse | operator-sdk | tumbleweed | 1.39.0-1.1 | fixed |
| Opensuse | hauler | tumbleweed | 1.1.1-2.1 | fixed |
| Opensuse | kepler | tumbleweed | 0.7.11-2.1 | fixed |
| Opensuse | yq | tumbleweed | 4.44.6-1.1 | fixed |
| Opensuse | govulncheck-vulndb | tumbleweed | 0.0.20241218T202206-1.1 | fixed |
| Opensuse | teleport | tumbleweed | 17.1.0-1.1 | fixed |
| Opensuse | helmfile | tumbleweed | 0.170.0-1.1 | fixed |
| Opensuse | kured | tumbleweed | 1.17.1-1.1 | fixed |
| Opensuse | sops | tumbleweed | 3.9.3-1.1 | fixed |
| Opensuse | helm | tumbleweed | 3.17.0-2.1 | fixed |
| Opensuse | kubelogin | tumbleweed | 0.1.7-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-golang-x-net | source | sid | 1:0.27.0-2 | not yet assigned | Not reported | [1091168] |
| Debian | golang-golang-x-net | source | forky | 1:0.27.0-2 | not yet assigned | Not reported | [1091168] |
| Debian | golang-golang-x-net | source | trixie | 1:0.27.0-2 | not yet assigned | Not reported | [1091168] |
| Debian | golang-golang-x-net | source | bookworm | (unfixed) | not yet assigned | Not reported | [1091168] |
| Ubuntu | adsys | deb | noble | 0.14.3~24.04ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | golang-golang-x-net | deb | noble | 1:0.21.0+dfsg-1ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | adsys-windows | deb | noble | 0.14.3~24.04ubuntu0.1 | Not reported | Not reported | Not reported |
| Ubuntu | golang-golang-x-net-dev | deb | noble | 1:0.21.0+dfsg-1ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Go | golang.org/x/net | Go | Not reported | 0.33.0 | Not reported | Not reported | Not reported |
| Opensuse | glab | rpm | leap 16.0 | 1.114.0-bp160.1.1 | Not reported | OPENSUSE-SU-2026:21662-1 | Not reported |
| Opensuse | lux | rpm | leap 16.0 | 0.24.1-bp160.1.1 | Not reported | OPENSUSE-SU-2026:21367-1 | Not reported |
| Opensuse | lux | rpm | tumbleweed | 0.24.1-1.1 | Not reported | OPENSUSE-SU-2026:11294-1 | Not reported |
| Ubuntu | golang-golang-x-net-dev | deb | pro | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1 | Not reported | USN-7197-1 | Not reported |
| Ubuntu | juju-core | deb | pro | 2.3.7-0ubuntu0.16.04.1+esm1 | Not reported | USN-7197-1 | Not reported |
| Ubuntu | adsys | deb | 20.04 | 0.9.2~20.04.2ubuntu0.1 | Not reported | USN-7197-1 | Not reported |
| Ubuntu | adsys | deb | 22.04 | 0.14.3~22.04ubuntu0.1 | Not reported | USN-7197-1 | Not reported |
| Ubuntu | golang-golang-x-net | deb | pro | 1:0.21.0+dfsg-1ubuntu0.1~esm1 | Not reported | USN-7197-1 | Not reported |
| Ubuntu | adsys | deb | 24.04 | 0.14.3~24.04ubuntu0.1 | Not reported | USN-7197-1 | Not reported |
| Opensuse | hauler | rpm | leap 16.0 | 1.3.1-bp160.1.1 | Not reported | OPENSUSE-SU-2025:20160-1 | Not reported |
| Opensuse | helmfile | rpm | leap 16.0 | 1.1.9-bp160.1.1 | Not reported | OPENSUSE-SU-2025:20097-1 | Not reported |
| Opensuse | traefik | rpm | tumbleweed | 3.4.3-1.1 | Not reported | OPENSUSE-SU-2025:15304-1 | Not reported |
| Suse | govulncheck-vulndb | rpm | linux enterprise module for package hub 15 sp6 | 0.0.20250108T191942-150000.1.26.1 | Not reported | SUSE-SU-2025:0060-1 | Not reported |
| Opensuse | govulncheck-vulndb | rpm | leap 15.6 | 0.0.20250108T191942-150000.1.26.1 | Not reported | SUSE-SU-2025:0060-1 | Not reported |
| Opensuse | operator-sdk | rpm | tumbleweed | 1.39.0-1.1 | Not reported | OPENSUSE-SU-2025:14634-1 | Not reported |
| Opensuse | hauler | rpm | tumbleweed | 1.1.1-2.1 | Not reported | OPENSUSE-SU-2025:14711-1 | Not reported |
| Opensuse | kepler | rpm | tumbleweed | 0.7.11-2.1 | Not reported | OPENSUSE-SU-2025:14640-1 | Not reported |
| Opensuse | yq | rpm | tumbleweed | 4.44.6-1.1 | Not reported | OPENSUSE-SU-2025:14639-1 | Not reported |
| Opensuse | govulncheck-vulndb | rpm | tumbleweed | 0.0.20241218T202206-1.1 | Not reported | OPENSUSE-SU-2024:14603-1 | Not reported |
| Opensuse | teleport | rpm | tumbleweed | 17.1.0-1.1 | Not reported | OPENSUSE-SU-2024:14606-1 | Not reported |
| Opensuse | helmfile | rpm | tumbleweed | 0.170.0-1.1 | Not reported | OPENSUSE-SU-2025:14666-1 | Not reported |
| Opensuse | kured | rpm | tumbleweed | 1.17.1-1.1 | Not reported | OPENSUSE-SU-2025:14907-1 | Not reported |
| Opensuse | sops | rpm | tumbleweed | 3.9.3-1.1 | Not reported | OPENSUSE-SU-2025:14612-1 | Not reported |
| Opensuse | helm | rpm | tumbleweed | 3.17.0-2.1 | Not reported | OPENSUSE-SU-2025:14725-1 | Not reported |
| Opensuse | kubelogin | rpm | tumbleweed | 0.1.7-1.1 | Not reported | OPENSUSE-SU-2025:14721-1 | Not reported |
Notes
[bookworm] golang-golang-x-net: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [golang-golang-x-net-dev]Affected
Source package: [golang-golang-x-net]
Details (2)
1:0.7.0+dfsg-1· all · bookwormAffected
usn · golang-golang-x-net · debian · bookworm; usn · golang-golang-x-net · debian · 12
1:0.7.0+dfsg-1· all · bookwormAffected
usn · golang-golang-x-net · debian · bookworm; usn · golang-golang-x-net · debian · 12
[openSUSE Tumbleweed]
- [helm-bash-completion]Unknown
Source package: [helm]
Details (1)
4.2.4-1.1· noarch · tumbleweedUnknown · Fixed:
3.17.0-2.1Version impact unknown
usn · helm · opensuse · tumbleweed
- [helmfile-bash-completion]Unknown
Source package: [helmfile]
Details (1)
1.7.4-1.1· noarch · tumbleweedUnknown · Fixed:
0.170.0-1.1Version impact unknown
usn · helmfile · opensuse · tumbleweed
- [helmfile-fish-completion]Unknown
Source package: [helmfile]
Details (1)
1.7.4-1.1· noarch · tumbleweedUnknown · Fixed:
0.170.0-1.1Version impact unknown
usn · helmfile · opensuse · tumbleweed
- [helmfile-zsh-completion]Unknown
Source package: [helmfile]
Details (1)
1.7.4-1.1· noarch · tumbleweedUnknown · Fixed:
0.170.0-1.1Version impact unknown
usn · helmfile · opensuse · tumbleweed
- [helm-fish-completion]Unknown
Source package: [helm]
Details (1)
4.2.4-1.1· noarch · tumbleweedUnknown · Fixed:
3.17.0-2.1Version impact unknown
usn · helm · opensuse · tumbleweed
- [helm-zsh-completion]Unknown
Source package: [helm]
Details (1)
4.2.4-1.1· noarch · tumbleweedUnknown · Fixed:
3.17.0-2.1Version impact unknown
usn · helm · opensuse · tumbleweed
- [kured-k8s-yaml]Unknown
Source package: [kured]
Details (1)
1.21.0-1.7· noarch · tumbleweedUnknown · Fixed:
1.17.1-1.1Version impact unknown
usn · kured · opensuse · tumbleweed
- [operator-sdk-bash-completion]Unknown
Source package: [operator-sdk]
Details (1)
1.42.3-1.3· noarch · tumbleweedUnknown · Fixed:
1.39.0-1.1Version impact unknown
usn · operator-sdk · opensuse · tumbleweed
- [operator-sdk-fish-completion]Unknown
Source package: [operator-sdk]
Details (1)
1.42.3-1.3· noarch · tumbleweedUnknown · Fixed:
1.39.0-1.1Version impact unknown
usn · operator-sdk · opensuse · tumbleweed
- [operator-sdk-zsh-completion]Unknown
Source package: [operator-sdk]
Details (1)
1.42.3-1.3· noarch · tumbleweedUnknown · Fixed:
1.39.0-1.1Version impact unknown
usn · operator-sdk · opensuse · tumbleweed
- [teleport-bash-completion]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· noarch · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-fdpass-teleport]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· x86_64 · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tbot]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· x86_64 · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tbot-bash-completion]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· noarch · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tbot-zsh-completion]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· noarch · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tctl]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· x86_64 · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tctl-bash-completion]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· noarch · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tctl-zsh-completion]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· noarch · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
- [teleport-tsh]Unknown
Source package: [teleport]
Details (1)
17.7.26-1.3· x86_64 · tumbleweedUnknown · Fixed:
17.1.0-1.1Version impact unknown
usn · teleport · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11294-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-45338]
- [https://osv.dev/vulnerability/GO-2024-3333]
- [https://osv.dev/vulnerability/SUSE-SU-2025:0060-1]
- [https://osv.dev/vulnerability/USN-7197-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14603-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14606-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14612-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14634-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14639-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14640-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14666-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14711-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14721-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14725-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14907-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15304-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:20097-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:20160-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11294-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21367-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21662-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-45338]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45338.json]
- [https://ubuntu.com/security/notices/USN-7197-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0226.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]