Malformed DNS message can cause infinite loop in net
Priority LOW 28CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 20 fixed, 42 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-835.
Summary
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00993 62nd percentileScored 2026-11-07
Fix Partial net (Go standard library): 1.22.3Red Hat: 24 advisoriesRed Hat: 20 fixed, 42 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net | 1.22.0-0 to before 1.22.3 | 1.22.3 | Patch available | CNA |
- net VendorGo standard library Affected 1.22.0-0 to before 1.22.3 Fixed in 1.22.3 Patch available CNA
Remediation
- Fix · CNA net (Go standard library) Fixed in 1.22.3
Red Hat 24 advisories
- RHSA-2025:9776 Released 2025-06-26 · Red Hat rating ImportantNew RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
- RHSA-2025:7256 Released 2025-05-13 · Red Hat rating Moderategit-lfs security update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.6.1-1.el9
- RHSA-2025:4240 Released 2025-04-28 · Red Hat rating ImportantUpdated 6.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
Show 21 more Red Hat advisories
- RHSA-2024:9485 Released 2024-11-13 · Red Hat rating ImportantControl plane Operators for RHOSO 18.0.3 (Feature Release 1) security update
- 9Base-RHOSO-1.0-PODIFIED rhoso-operators/barbican-rhel9-operator, rhoso-operators/cinder-rhel9-operator, rhoso-operators/designate-rhel9-operator +22
- RHSA-2024:9115 Released 2024-11-12 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-4.el9, grafana-selinux-10.2.6-4.el9
- RHSA-2024:9277 Released 2024-11-12 · Red Hat rating Moderateoci-seccomp-bpf-hook security update
- Red Hat Enterprise Linux AppStream (v. 9) oci-seccomp-bpf-hook-1.2.10-2.el9
- RHSA-2024:9098 Released 2024-11-12 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.16.1-1.el9, skopeo-tests-2:1.16.1-1.el9
- RHSA-2024:9089 Released 2024-11-12 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.5.1-2.el9
- RHSA-2024:9135 Released 2024-11-12 · Red Hat rating Moderatetoolbox security update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.5-5.el9, toolbox-tests-0.0.99.5-5.el9
- RHSA-2024:9200 Released 2024-11-12 · Red Hat rating Moderaterunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.13-4.el9
- RHSA-2024:6341 Released 2024-10-23 · Red Hat rating ModerateKube Descheduler Operator for Red Hat OpenShift 5.1.0 for RHEL 9
- KDO 5.1 for RHEL 9 kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-operator-bundle, kube-descheduler-operator/kube-descheduler-rhel9-operator
- RHSA-2024:7548 Released 2024-10-16 · Red Hat rating ModerateRun Once Duration Override Operator for Red Hat OpenShift 1.2.0 for RHEL 9
- RODOO 1.2 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2024:7164 Released 2024-09-26 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8
- RHSA-2024:6969 Released 2024-09-24 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.s390x::container-tools:rhel8 +47
- RHSA-2024:6765 Released 2024-09-18 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-4.5.11-1.el8ap, automation-controller-cli-4.5.11-1.el8ap, automation-controller-server-4.5.11-1.el8ap +10
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-4.5.11-1.el9ap, automation-controller-cli-4.5.11-1.el9ap, automation-controller-server-4.5.11-1.el9ap +10
- RHSA-2024:6221 Released 2024-09-03 · Red Hat rating CriticalThe Red Hat OpenShift Builds 1.1.0 General Availability
- Builds for Red Hat OpenShift
- RHSA-2024:5547 Released 2024-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.1 bug fix and security update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +2
- RHSA-2024:5291 Released 2024-08-13 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-17.el8_10, grafana-selinux-9.2.10-17.el8_10
- RHSA-2024:5013 Released 2024-08-05 · Red Hat rating CriticalThe Red Hat OpenShift Builds Client 1.1.0 General Availability
- Builds for Red Hat OpenShift 1.1.1 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel9
- RHSA-2024:4982 Released 2024-08-01 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.3.3 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator, oadp/oadp-velero-restic-restore-helper-rhel9 +1
- RHSA-2024:4872 Released 2024-07-25 · Red Hat rating ModerateRelease of OpenShift Serverless 1.33.1 security update
- Red Hat OpenShift Serverless 1.33 openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8 +33
- RHSA-2024:4616 Released 2024-07-24 · Red Hat rating ModerateOpenShift Container Platform 4.16.4 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.16 python-jinja2-3.0.1-3.el9.1, python3-jinja2-3.0.1-3.el9.1
- Red Hat OpenShift Container Platform 4.16 openshift-clients-4.16.0-202407111006.p0.gfa84651.assembly.stream.el8, openshift-clients-4.16.0-202407111006.p0.gfa84651.assembly.stream.el9, openshift-clients-redistributable-4.16.0-202407111006.p0.gfa84651.assembly.stream.el8 +11
- RHSA-2024:4613 Released 2024-07-24 · Red Hat rating ModerateOpenShift Container Platform 4.16.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/egress-router-cni-rhel9, openshift4/network-tools-rhel9, openshift4/ose-agent-installer-api-server-rhel9 +35
- RHSA-2024:4697 Released 2024-07-22 · Red Hat rating ModerateRed Hat build of Cryostat security update
- Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-db-rhel8, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management Metrics Operator | Affected | No fix yet |
| Cryostat 2 | Affected | No fix yet |
| Fence Agents Remediation Operator | Affected | No fix planned: Will not fix |
| Logical Volume Manager Storage | Affected | No fix planned: Will not fix |
| Machine Deletion Remediation Operator | Affected | No fix yet |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Applications 7 | Affected | No fix planned: Will not fix |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| Node Maintenance Operator | Affected | No fix planned: Will not fix |
| OpenShift Secondary Scheduler Operator | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Source-to-Image (S2I) | Affected | No fix yet |
| Power monitoring for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Service Interconnect 1 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.5 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-MTV-2.6 | Fixed | — |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:7164 |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:4982 |
| 9Base-RHOSO-1.0-PODIFIED | Fixed | RHSA-2024:9485 |
| Builds for Red Hat OpenShift | Fixed | RHSA-2024:6221 |
| Builds for Red Hat OpenShift 1.1.1 | Fixed | RHSA-2024:5013 |
| Cryostat 3 on RHEL 8 | Fixed | RHSA-2024:4697 |
| KDO 5.1 for RHEL 9 | Fixed | RHSA-2024:6341 |
| OpenShift Developer Tools and Services for OCP 4.17 | Fixed | — |
| OpenShift Pipelines version 1.16 for RHEL 8 | Fixed | — |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:5547 |
| RODOO 1.2 for RHEL 9 | Fixed | RHSA-2024:7548 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:6765 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:6765 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2025:4240 |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:9776 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:5291, RHSA-2024:6969 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:9089, RHSA-2024:9098, RHSA-2024:9115, RHSA-2024:9135, RHSA-2024:9200, RHSA-2024:9277, RHSA-2025:7256 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:4613, RHSA-2024:4616 |
| Red Hat OpenShift Serverless 1.33 | Fixed | RHSA-2024:4872 |
Not affected: 19 products
- 8Base-RHMTC-1.8
- 9Base-OADP-1.3
- Builds for Red Hat OpenShift 1.1.1
- Custom Metric Autoscaler operator for Red Hat Openshift
- Ironic content for Red Hat OpenShift Container Platform 4.16
- Logging Subsystem for Red Hat OpenShift
- Network Observability Operator
- OpenShift Developer Tools and Services
- RHODF 4.16 for RHEL 9
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24788
- 2026-10-03 Alias added: GHSA-2jwv-jmq4-4j3r
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: 8Base-MTV-2.6 · Red Hat
References
Other 7
- https://go.dev/issue/66754
- https://go.dev/cl/578375
- https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
- https://pkg.go.dev/vuln/GO-2024-2824
- http://www.openwall.com/lists/oss-security/2024/05/08/3
- https://security.netapp.com/advisory/ntap-20240605-0002/
- https://security.netapp.com/advisory/ntap-20240614-0001/
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24788 · CVE Program
- CVE-2024-24788 · NVD
- FIRST EPSS
- GHSA-2jwv-jmq4-4j3r · GitHub Advisory Database · CC BY 4.0
- CVE-2024-24788 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences