Vulnerability · Published Jun 5, 2024 · Assigned by Go
CVE-2024-24790Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
Critical 9.8
In plain English
A critical-severity security flaw in net/netip from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.0%top 19.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.21.2-3.module_el8.10.0+3760+4dd778f9 | ALSA-2024:4237 |
| AlmaLinux:9 | git-lfs | 3.6.1-1.el9 | ALSA-2025:7256 |
| AlmaLinux:8 | go-toolset | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | go-toolset | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | golang | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | golang | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | golang-bin | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | golang-bin | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | golang-docs | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | golang-docs | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | golang-misc | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | golang-misc | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | golang-src | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | golang-src | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | golang-tests | 1.21.11-1.module_el8.10.0+3863+bb82df69 | ALSA-2024:4237 |
| AlmaLinux:9 | golang-tests | 1.21.11-1.el9_4 | ALSA-2024:4212 |
| AlmaLinux:8 | grafana | 9.2.10-17.el8_10 | ALSA-2024:5291 |
| AlmaLinux:9 | grafana | 10.2.6-4.el9 | ALSA-2024:9115 |
| AlmaLinux:8 | grafana-selinux | 9.2.10-17.el8_10 | ALSA-2024:5291 |
| AlmaLinux:9 | grafana-selinux | 10.2.6-4.el9 | ALSA-2024:9115 |
| Alpine:v3.20 | go | 1.22.4-r0 | ALPINE-CVE-2024-24790 |
| Alpine:v3.21 | go | 1.22.4-r0 | ALPINE-CVE-2024-24790 |
| Alpine:v3.22 | go | 1.22.4-r0 | ALPINE-CVE-2024-24790 |
| Alpine:v3.23 | go | 1.22.4-r0 | ALPINE-CVE-2024-24790 |
| Alpine:v3.24 | go | 1.22.4-r0 | ALPINE-CVE-2024-24790 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2024-24790 |
| Go | stdlib | 1.21.11, 1.22.4 | GO-2024-2887 |
| Rocky Linux:8 | delve | 0:1.21.2-3.module+el8.10.0+1814+f68f8a63 | RLSA-2024:4237 |
| Rocky Linux:8 | delve | 0:1.22.1-1.module+el8.10.0+1879+0cb86608 | RLSA-2024:8876 |
| Rocky Linux:9 | git-lfs | 0:3.6.1-1.el9 | RLSA-2025:7256 |
| Rocky Linux:8 | go-toolset | 0:1.22.7-1.module+el8.10.0+1879+0cb86608 | RLSA-2024:8876 |
| Rocky Linux:8 | go-toolset | 0:1.21.11-1.module+el8.10.0+1831+fc70fba6 | RLSA-2024:4237 |
| Rocky Linux:8 | golang | 0:1.22.7-1.module+el8.10.0+1879+0cb86608 | RLSA-2024:8876 |
| Rocky Linux:8 | golang | 0:1.21.11-1.module+el8.10.0+1831+fc70fba6 | RLSA-2024:4237 |
| Rocky Linux:9 | golang | 0:1.21.11-1.el9_4 | RLSA-2024:4212 |
| Rocky Linux:8 | grafana | 0:9.2.10-17.el8_10 | RLSA-2024:5291 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2024-24790 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | USN-7109-1 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | UBUNTU-CVE-2024-24790 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2024-24790 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.3 | USN-6886-1 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.3 | UBUNTU-CVE-2024-24790 |
| Ubuntu:24.04:LTS | golang-1.21 | 1.21.9-1ubuntu0.1 | USN-6886-1 |
| Ubuntu:24.04:LTS | golang-1.21 | 1.21.9-1ubuntu0.1 | UBUNTU-CVE-2024-24790 |
| Ubuntu:22.04:LTS | golang-1.22 | 1.22.2-2~22.04.1 | UBUNTU-CVE-2024-24790 |
| Ubuntu:22.04:LTS | golang-1.22 | 1.22.2-2~22.04.1 | USN-6886-1 |
| Ubuntu:24.04:LTS | golang-1.22 | 1.22.2-2ubuntu0.1 | USN-6886-1 |
| Ubuntu:24.04:LTS | golang-1.22 | 1.22.2-2ubuntu0.1 | UBUNTU-CVE-2024-24790 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/netip | 0 – before 1.21.111.22.0-0 – before 1.22.4 |