Errors returned from JSON marshaling may break template escaping in html/template
Priority LOW 26Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 21 fixed, 31 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00795 56th percentileScored 2026-11-07
Fix Partial html/template (Go standard library): 1.21.8, 1.22.1Red Hat: 23 advisoriesRed Hat: 21 fixed, 31 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | html/template | before 1.21.8; 1.22.0-0 to before 1.22.1 | 1.21.8, 1.22.1 | Patch available | CNA |
- html/template VendorGo standard library Affected before 1.21.8; 1.22.0-0 to before 1.22.1 Fixed in 1.21.8, 1.22.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | — | — | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions — — ·Go standard library
Remediation
- Fix · CNA html/template (Go standard library) Fixed in 1.21.8, 1.22.1
Red Hat 23 advisories
- RHSA-2026:3428 Released 2026-02-26 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+23963+b64d8032.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23963+b64d8032.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23963+b64d8032.s390x::container-tools:rhel8 +47
- RHSA-2025:9776 Released 2025-06-26 · Red Hat rating ImportantNew RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
- RHSA-2024:9485 Released 2024-11-13 · Red Hat rating ImportantControl plane Operators for RHOSO 18.0.3 (Feature Release 1) security update
- 9Base-RHOSO-1.0-PODIFIED rhoso-operators/barbican-rhel9-operator, rhoso-operators/cinder-rhel9-operator, rhoso-operators/designate-rhel9-operator +22
Show 20 more Red Hat advisories
- RHSA-2024:9135 Released 2024-11-12 · Red Hat rating Moderatetoolbox security update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.5-5.el9, toolbox-tests-0.0.99.5-5.el9
- RHSA-2024:6221 Released 2024-09-03 · Red Hat rating CriticalThe Red Hat OpenShift Builds 1.1.0 General Availability
- Builds for Red Hat OpenShift
- RHSA-2024:5013 Released 2024-08-05 · Red Hat rating CriticalThe Red Hat OpenShift Builds Client 1.1.0 General Availability
- Builds for Red Hat OpenShift 1.1.1 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel9
- RHSA-2024:4893 Released 2024-07-29 · Red Hat rating Moderaterhc-worker-script security update
- Red Hat Enterprise Linux Server (v. 7 ELS) rhc-worker-script-0.9-5.el7_9
- RHSA-2024:4591 Released 2024-07-17 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
- RHSA-2024:4520 Released 2024-07-11 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.16 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-rsync-transfer-rhel8 +2
- RHSA-2024:3617 Released 2024-07-01 · Red Hat rating ModerateKube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9
- KDO 5.0 for RHEL 9 kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-operator-bundle, kube-descheduler-operator/kube-descheduler-rhel9-operator
- RHSA-2024:3637 Released 2024-07-01 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9
- OSSO 1.3 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
- RHSA-2024:1616 Released 2024-07-01 · Red Hat rating ImportantRun Once Duration Override Operator for Red Hat OpenShift 1.1.1 for RHEL 9
- RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2024:0045 Released 2024-06-27 · Red Hat rating ImportantOpenShift Container Platform 4.16.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.16 python-eventlet-0.33.1-6.el9, python3-eventlet-0.33.1-6.el9
- Red Hat OpenShift Container Platform 4.16 butane-0.21.0-1.rhaos4.16.el8, butane-redistributable-0.21.0-1.rhaos4.16.el8, cri-o-1.29.5-5.rhaos4.16.git7032128.el8 +43
- RHSA-2024:0041 Released 2024-06-27 · Red Hat rating CriticalOpenShift Container Platform 4.16.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:4028 Released 2024-06-20 · Red Hat rating ModerateRelease of OpenShift Serverless 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.33 openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8 +33
- RHSA-2024:4023 Released 2024-06-20 · Red Hat rating ImportantRelease of openshift-serverless-clients kn 1.33.0 security update & enhancements
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.12.0-7.el8
- RHSA-2024:3868 Released 2024-06-17 · Red Hat rating ImportantNetwork Observability 1.6.0 for OpenShift
- NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:3790 Released 2024-06-11 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.3.2 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-rhel9
- RHSA-2024:3621 Released 2024-06-05 · Red Hat rating ImportantRed Hat OpenShift distributed tracing 3.2.0 operator/operand containers update
- Red Hat OpenShift distributed tracing 3.2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16
- RHSA-2024:2901 Released 2024-05-23 · Red Hat rating LowCustom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
- RHSA-2024:3259 Released 2024-05-22 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.src::go-toolset:rhel8 +19
- RHSA-2024:2096 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.9.1
- RHOL 5.9 for RHEL 9 openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel9
- RHSA-2024:2562 Released 2024-04-30 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.9-2.el9_4, golang-1.21.9-2.el9_4, golang-bin-1.21.9-2.el9_4 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management Metrics Operator | Affected | No fix yet |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| Node Maintenance Operator | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Out of support scope |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Service Interconnect 1 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Self Node Remediation Operator | Affected | No fix yet |
| 8Base-MTV-2.6 | Fixed | — |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2024:4520 |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:3790 |
| 9Base-RHOSO-1.0-PODIFIED | Fixed | RHSA-2024:9485 |
| Builds for Red Hat OpenShift | Fixed | RHSA-2024:6221 |
| Builds for Red Hat OpenShift 1.1.1 | Fixed | RHSA-2024:5013 |
| KDO 5.0 for RHEL 9 | Fixed | RHSA-2024:3617 |
| NETOBSERV 1.6 for RHEL 9 | Fixed | RHSA-2024:3868 |
| OSSO 1.3 for RHEL 9 | Fixed | RHSA-2024:3637 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2024:2901 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:4591 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:2096 |
| RODOO 1.1 for RHEL 9 | Fixed | RHSA-2024:1616 |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:9776 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3259, RHSA-2026:3428 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2562, RHSA-2024:9135 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2024:4893 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:0041, RHSA-2024:0045 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2024:4023 |
| Red Hat OpenShift Serverless 1.33 | Fixed | RHSA-2024:4028 |
| Red Hat OpenShift distributed tracing 3.2 | Fixed | RHSA-2024:3621 |
Not affected: 14 products
- 8Base-RHMTC-1.7
- 9Base-OADP-1.3
- Builds for Red Hat OpenShift 1.1.1
- Ironic content for Red Hat OpenShift Container Platform 4.16
- Logical Volume Manager Storage
- Migration Toolkit for Applications 7
- RHODF 4.16 for RHEL 9
- RHOL 5.9 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenStack Platform 16.2
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24785
- 2026-10-03 Alias added: GHSA-j6m3-gc37-6r6q
- 2026-10-30 Fix available: 8Base-MTV-2.6 · Red Hat
References
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24785 · CVE Program
- CVE-2024-24785 · NVD
- FIRST EPSS
- GHSA-j6m3-gc37-6r6q · GitHub Advisory Database · CC BY 4.0
- CVE-2024-24785 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences