golang.org/x/net : = 0.0.0-20211112202133-69e39bad7dc2 - Non-linear parsing of case-insensitive content in golang.org/x/net/html #3
Description
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338
- x/net/html: non-linear parsing of case-insensitive content golang/go#70906
- https://go.dev/cl/637536
- https://go.dev/issue/70906
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
- https://pkg.go.dev/vuln/GO-2024-3333
- GHSA-w32m-9786-jp63
File Path: go.mod
Mitigation: Patched version: 0.33.0
Finding Id : 305022927
Tool Finding Id: RVA_kwDON3wZgs8AAAABWh2aKw