Verify panics on certificates with an unknown public key algorithm in crypto/x509
Priority LOW 28CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 33 fixed, 39 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00667 52nd percentileScored 2026-11-07
Fix Partial crypto/x509 (Go standard library): 1.21.8, 1.22.1Red Hat: 37 advisoriesRed Hat: 33 fixed, 39 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | crypto/x509 | before 1.21.8; 1.22.0-0 to before 1.22.1 | 1.21.8, 1.22.1 | Patch available | CNA |
- crypto/x509 VendorGo standard library Affected before 1.21.8; 1.22.0-0 to before 1.22.1 Fixed in 1.21.8, 1.22.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | — | — | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions — — ·Go standard library
Remediation
- Fix · CNA crypto/x509 (Go standard library) Fixed in 1.21.8, 1.22.1
Red Hat 37 advisories
- RHSA-2025:9776 Released 2025-06-26 · Red Hat rating ImportantNew RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
- RHSA-2025:0536 Released 2025-01-21 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.15.0
- cert-manager operator for Red Hat OpenShift 1.15 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2024:9485 Released 2024-11-13 · Red Hat rating ImportantControl plane Operators for RHOSO 18.0.3 (Feature Release 1) security update
- 9Base-RHOSO-1.0-PODIFIED rhoso-operators/barbican-rhel9-operator, rhoso-operators/cinder-rhel9-operator, rhoso-operators/designate-rhel9-operator +22
Show 34 more Red Hat advisories
- RHSA-2024:6969 Released 2024-09-24 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.s390x::container-tools:rhel8 +47
- RHSA-2024:6194 Released 2024-09-03 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-10.el9_4, podman-docker-4:4.9.4-10.el9_4, podman-plugins-4:4.9.4-10.el9_4 +2
- RHSA-2024:6186 Released 2024-09-03 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.4.0-5.el9_4
- RHSA-2024:6188 Released 2024-09-03 · Red Hat rating Moderaterunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.12-4.el9_4
- RHSA-2024:6221 Released 2024-09-03 · Red Hat rating CriticalThe Red Hat OpenShift Builds 1.1.0 General Availability
- Builds for Red Hat OpenShift
- RHSA-2024:6195 Released 2024-09-03 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.14.5-1.el9_4, skopeo-tests-2:1.14.5-1.el9_4
- RHSA-2024:6189 Released 2024-09-03 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.7-4.el9_4, buildah-tests-2:1.33.7-4.el9_4
- RHSA-2024:6187 Released 2024-09-03 · Red Hat rating Moderategvisor-tap-vsock security update
- Red Hat Enterprise Linux AppStream (v. 9) gvisor-tap-vsock-6:0.7.3-5.el9_4
- RHSA-2024:5258 Released 2024-08-13 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.s390x::container-tools:rhel8 +47
- RHSA-2024:5013 Released 2024-08-05 · Red Hat rating CriticalThe Red Hat OpenShift Builds Client 1.1.0 General Availability
- Builds for Red Hat OpenShift 1.1.1 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel9
- RHSA-2024:4893 Released 2024-07-29 · Red Hat rating Moderaterhc-worker-script security update
- Red Hat Enterprise Linux Server (v. 7 ELS) rhc-worker-script-0.9-5.el7_9
- RHSA-2024:4591 Released 2024-07-17 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
- RHSA-2024:4520 Released 2024-07-11 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.16 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-rsync-transfer-rhel8 +2
- RHSA-2024:3617 Released 2024-07-01 · Red Hat rating ModerateKube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9
- KDO 5.0 for RHEL 9 kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-operator-bundle, kube-descheduler-operator/kube-descheduler-rhel9-operator
- RHSA-2024:3637 Released 2024-07-01 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9
- OSSO 1.3 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
- RHSA-2024:1616 Released 2024-07-01 · Red Hat rating ImportantRun Once Duration Override Operator for Red Hat OpenShift 1.1.1 for RHEL 9
- RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2024:0045 Released 2024-06-27 · Red Hat rating ImportantOpenShift Container Platform 4.16.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.16 python-eventlet-0.33.1-6.el9, python3-eventlet-0.33.1-6.el9
- Red Hat OpenShift Container Platform 4.16 butane-0.21.0-1.rhaos4.16.el8, butane-redistributable-0.21.0-1.rhaos4.16.el8, cri-o-1.29.5-5.rhaos4.16.git7032128.el8 +43
- RHSA-2024:0041 Released 2024-06-27 · Red Hat rating CriticalOpenShift Container Platform 4.16.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:4125 Released 2024-06-26 · Red Hat rating ImportantRed Hat Service Interconnect 1.4.5 Release security update
- 9Base-Service-Interconnect-1.4 skupper-cli-1.4.5-1.el9
- Red Hat Service Interconnect 1.4 skupper-cli-1.4.5-1.el8
- RHSA-2024:4034 Released 2024-06-20 · Red Hat rating ImportantRed Hat Service Interconnect 1.5.4 Release security update (images)
- Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-container-rhel9, service-interconnect/skupper-controller-podman-rhel9 +5
- RHSA-2024:4028 Released 2024-06-20 · Red Hat rating ModerateRelease of OpenShift Serverless 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.33 openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8 +33
- RHSA-2024:4023 Released 2024-06-20 · Red Hat rating ImportantRelease of openshift-serverless-clients kn 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.12.0-7.el8
- RHSA-2024:3868 Released 2024-06-17 · Red Hat rating ImportantNetwork Observability 1.6.0 for OpenShift
- NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:3790 Released 2024-06-11 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.3.2 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-rhel9
- RHSA-2024:3781 Released 2024-06-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
- RHSA-2024:3621 Released 2024-06-05 · Red Hat rating ImportantRed Hat OpenShift distributed tracing 3.2.0 operator/operand containers update
- Red Hat OpenShift distributed tracing 3.2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16
- RHSA-2024:3346 Released 2024-05-23 · Red Hat rating Importantgit-lfs security update
- Red Hat Enterprise Linux AppStream (v. 8) git-lfs-3.4.1-2.el8_10
- RHSA-2024:2901 Released 2024-05-23 · Red Hat rating LowCustom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
- RHSA-2024:3259 Released 2024-05-22 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.src::go-toolset:rhel8 +19
- RHSA-2024:2941 Released 2024-05-21 · Red Hat rating ImportantRHACS 4.4 enhancement and security update
- RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
- RHSA-2024:2724 Released 2024-05-07 · Red Hat rating Importantgit-lfs security update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.4.1-2.el9_4
- RHSA-2024:2096 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.9.1
- RHOL 5.9 for RHEL 9 openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel9
- RHSA-2024:2562 Released 2024-04-30 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.9-2.el9_4, golang-1.21.9-2.el9_4, golang-bin-1.21.9-2.el9_4 +4
- RHSA-2024:2088 Released 2024-04-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management Metrics Operator | Affected | No fix yet |
| Fence Agents Remediation Operator | Affected | No fix planned: Will not fix |
| Machine Deletion Remediation Operator | Affected | No fix yet |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| Node Maintenance Operator | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Source-to-Image (S2I) | Affected | No fix yet |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Web Terminal | Affected | No fix yet: Fix deferred |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.5 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-MTV-2.6 | Fixed | — |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2024:4520 |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:3790 |
| 9Base-RHOSO-1.0-PODIFIED | Fixed | RHSA-2024:9485 |
| 9Base-Service-Interconnect-1.4 | Fixed | RHSA-2024:4125 |
| Builds for Red Hat OpenShift | Fixed | RHSA-2024:6221 |
| Builds for Red Hat OpenShift 1.1.1 | Fixed | RHSA-2024:5013 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2024:2088 |
| KDO 5.0 for RHEL 9 | Fixed | RHSA-2024:3617 |
| LVMS 4.13 for RHEL 8 | Fixed | — |
| LVMS 4.14 for RHEL 9 | Fixed | — |
| LVMS 4.15 for RHEL 9 | Fixed | — |
| LVMS 4.16 for RHEL 9 | Fixed | — |
| NETOBSERV 1.6 for RHEL 9 | Fixed | RHSA-2024:3868 |
| OSSO 1.3 for RHEL 9 | Fixed | RHSA-2024:3637 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2024:2901 |
| RHACS 4.4 for RHEL 8 | Fixed | RHSA-2024:2941 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:4591 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:2096 |
| RODOO 1.1 for RHEL 9 | Fixed | RHSA-2024:1616 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:3781 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:3781 |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:9776 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3259, RHSA-2024:3346, RHSA-2024:5258, RHSA-2024:6969 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2562, RHSA-2024:2724, RHSA-2024:6186, RHSA-2024:6187, RHSA-2024:6188, RHSA-2024:6189, RHSA-2024:6194, RHSA-2024:6195 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2024:4893 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:0041, RHSA-2024:0045 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2024:4023 |
| Red Hat OpenShift Serverless 1.33 | Fixed | RHSA-2024:4028 |
| Red Hat OpenShift distributed tracing 3.2 | Fixed | RHSA-2024:3621 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2024:4034 |
| Red Hat Service Interconnect 1.4 | Fixed | RHSA-2024:4125 |
| cert-manager operator for Red Hat OpenShift 1.15 | Fixed | RHSA-2025:0536 |
Not affected: 13 products
- 8Base-RHMTC-1.7
- 9Base-OADP-1.3
- Builds for Red Hat OpenShift 1.1.1
- Ironic content for Red Hat OpenShift Container Platform 4.16
- Migration Toolkit for Applications 7
- RHODF 4.16 for RHEL 9
- RHOL 5.9 for RHEL 9
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.16
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24783
- 2026-10-03 Alias added: GHSA-3q2c-pvp5-3cqp
- 2026-10-30 Fix available: 8Base-MTV-2.6, LVMS 4.15 for RHEL 9, LVMS 4.16 for RHEL 9 · Red Hat
References
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24783 · CVE Program
- CVE-2024-24783 · NVD
- FIRST EPSS
- GHSA-3q2c-pvp5-3cqp · GitHub Advisory Database · CC BY 4.0
- CVE-2024-24783 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences