golang.org/x/net : = 0.0.0-20211112202133-69e39bad7dc2 - Non-linear parsing of case-insensitive content in golang.org/x/net/html

[vincent-goyal]

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-45338
• x/net/html: non-linear parsing of case-insensitive content golang/go#70906
• https://go.dev/cl/637536
• https://go.dev/issue/70906
• https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
• https://pkg.go.dev/vuln/GO-2024-3333
• GHSA-w32m-9786-jp63

File Path: go.mod

Mitigation: Patched version: 0.33.0

Finding Id : 305022927

Tool Finding Id: RVA_kwDON3wZgs8AAAABWh2aKw

[vincent-goyal]

Finding [305022927] status changed to Confirmed
Note:
by [email protected] via ArmorCode Platform

[vincent-goyal]

The corresponding finding 305022927 is deleted from ArmorCode
by [email protected] via ArmorCode Platform