Skip to main content

Inefficient Regular Expression Complexity in github.com/golang/net

CVE-2024-45338

  • github.com/golang/net
  • golang/net
  • golang.org/x/net
  • golang.org/x/net/http2
High
8.7/10

Summary

An attacker can craft an input to the "Parse" function, that will be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a Denial of Service. This issue affects github.com/golang/net package versions prior to 0.33.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published