CVE-2024-24788
Medium · 5.9CVSS
5.9
EPSS
1.0%
Published
May 8, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A bug in certain versions of the Go programming language can make programs that look up website addresses freeze when they receive odd network replies, potentially taking services offline until restarted.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- High
- Impact
- Denial Of Service
- Component
- Library
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Malformed DNS responses cause Go Lookup functions to enter an infinite loop, resulting in denial of service via high CPU consumption and thread/process hangs.
Why it matters to the business
Services relying on DNS resolution in affected Go versions can become unresponsive or crash under load, causing outages and requiring restarts; the issue affects Debian-packaged Go 1.22 and has been public for an extended period without widespread exploitation.
How an attack unfolds
An attacker triggers a DNS query from a vulnerable Go application and responds with a crafted malformed DNS message that forces the resolver into an infinite loop, hanging the calling function.
How to fix it
Upgrade golang-1.22 on Debian 13 to version 1.22.3-1 or later; rebuild and redeploy affected applications with the patched Go toolchain.
How to confirm the fix worked
Verify installed package versions match or exceed the fixed releases; test DNS resolution paths with tools that can inject malformed responses to confirm loop termination.
Typical attack path
- Identify services using Go net package DNS lookup functions
- Send a query that elicits a DNS response
- Return a malformed DNS packet designed to trigger the loop condition
- Observe resource exhaustion or application hang on the target
How to detect it
Review process lists and resource utilization for Go applications stuck on DNS resolution; inspect logs for repeated or hanging DNS query activity preceding performance degradation.
What your security team should do
- Apply the 1.22.3-1 package update across all Debian 13 systems immediately
- Scan codebases for direct or indirect use of net.Lookup* functions and prioritize patching
- Monitor EPSS and exploit maturity indicators for any future increase in activity
The record
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | stdlib | 1.22.0-0 | 1.22.3 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.0-1.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.0-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | buildah | 0 | 2:1.33.8-4.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | buildah-tests | 0 | 2:1.33.8-4.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | cockpit-podman | 0 | 84.1-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | container-selinux | 0 | 2:2.229.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3859+6ae70a0e |
| AlmaLinux:8 | grafana | 0 | 9.2.10-17.el8_10 |
| AlmaLinux:8 | grafana-selinux | 0 | 9.2.10-17.el8_10 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | podman | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-catatonit | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-docker | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-gvproxy | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-plugins | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-remote | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | podman-tests | 0 | 4:4.9.4-13.module_el8.10.0+3898+7a25cb1a |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | python3-podman | 0 | 4.9.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | runc | 0 | 1:1.1.12-4.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-3.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | udica | 0 | 0.2.6-21.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:9 | containernetworking-plugins | 0 | 1:1.5.1-2.el9 |
| AlmaLinux:9 | git-lfs | 0 | 3.6.1-1.el9 |
| AlmaLinux:9 | grafana | 0 | 10.2.6-4.el9 |
| AlmaLinux:9 | grafana-selinux | 0 | 10.2.6-4.el9 |
| AlmaLinux:9 | oci-seccomp-bpf-hook | 0 | 1.2.10-2.el9 |
| AlmaLinux:9 | runc | 0 | 4:1.1.13-4.el9 |
| AlmaLinux:9 | skopeo | 0 | 2:1.16.1-1.el9 |
| AlmaLinux:9 | skopeo-tests | 0 | 2:1.16.1-1.el9 |
| AlmaLinux:9 | toolbox | 0 | 0.0.99.5-5.el9 |
| AlmaLinux:9 | toolbox-tests | 0 | 0.0.99.5-5.el9 |
| Bitnami | golang | 1.22.0-0 | 1.22.3 |
| Chainguard | aactl | 0 | 0.4.12-r12 |
| Chainguard | actions-runner-controller-fips | 0 | 0.9.1-r1 |
| Chainguard | actions-runner-controller-fips-compat | 0 | 0.9.1-r1 |
| Chainguard | addon-resizer-fips | 0 | 1.8.21-r0 |
| Chainguard | addon-resizer-fips-compat | 0 | 1.8.21-r0 |
| Chainguard | argo-cd-2.9 | 0 | 2.9.14-r1 |
| Chainguard | argo-cd-2.9-compat | 0 | 2.9.14-r1 |
| Chainguard | argo-cd-2.9-repo-server | 0 | 2.9.14-r1 |
| Chainguard | argo-cd-fips-2.10 | 0 | 2.10.9-r1 |
| Chainguard | argo-cd-fips-2.10-compat | 0 | 2.10.9-r1 |
| Chainguard | argo-cd-fips-2.10-repo-server | 0 | 2.10.9-r1 |
| Chainguard | argo-cd-fips-2.8 | 0 | 2.8.18-r1 |
| Chainguard | argo-cd-fips-2.8-compat | 0 | 2.8.18-r1 |
| Chainguard | argo-cd-fips-2.8-repo-server | 0 | 2.8.18-r1 |
| Chainguard | argo-cd-fips-2.9 | 0 | 2.9.14-r1 |
| Chainguard | argo-cd-fips-2.9-compat | 0 | 2.9.14-r1 |
| Chainguard | argo-cd-fips-2.9-repo-server | 0 | 2.9.14-r1 |
| Chainguard | argo-workflow-cli-fips | 0 | 3.5.6-r2 |
| Chainguard | argo-workflow-controller-compat-fips | 0 | 3.5.6-r2 |
| Chainguard | argo-workflow-controller-fips | 0 | 3.5.6-r2 |
| Chainguard | argo-workflow-executor-compat-fips | 0 | 3.5.6-r2 |
| Chainguard | argo-workflow-executor-fips | 0 | 3.5.6-r2 |
| Chainguard | argo-workflows-fips | 0 | 3.5.6-r2 |
| Chainguard | argo-workflows-known-hosts-fips | 0 | 3.5.6-r2 |
| Chainguard | atlantis | 0 | 0.27.3-r1 |
| Chainguard | atlantis-fips | 0 | 0.27.3-r1 |
| Chainguard | aws-ebs-csi-driver | 0 | 1.30.0-r1 |
| Chainguard | aws-ebs-csi-driver-1.18 | 0 | 1.18.0-r17 |
| Chainguard | aws-ebs-csi-driver-1.19 | 0 | 1.19.0-r16 |
| Chainguard | aws-ebs-csi-driver-fips | 0 | 1.31.0-r0 |
| Chainguard | aws-efs-csi-driver | 0 | 2.0.2-r1 |
| Chainguard | aws-efs-csi-driver-fips | 0 | 1.7.0-r10 |
| Chainguard | aws-efs-csi-driver-fips-1.6 | 0 | 1.6.0-r10 |
| Chainguard | aws-flb-cloudwatch-compat-fips | 0 | 1.9.4-r3 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r3 |
| Chainguard | aws-flb-firehose-compat-fips | 0 | 1.7.2-r3 |
| Chainguard | aws-flb-firehose-fips | 0 | 1.7.2-r3 |
| Chainguard | aws-flb-kinesis-compat-fips | 0 | 1.10.2-r4 |
| Chainguard | aws-flb-kinesis-fips | 0 | 1.10.2-r4 |
| Chainguard | aws-load-balancer-controller-2.4.5 | 0 | 2.4.5-r12 |
| Chainguard | aws-load-balancer-controller-2.5 | 0 | 2.5.4-r6 |
| Chainguard | aws-load-balancer-controller-compat-2.4.5 | 0 | 2.5.4-r6 |
| Chainguard | aws-load-balancer-controller-fips | 0 | 2.7.2-r4 |
| Chainguard | azure-aad-pod-identity-mic | 0 | 1.8.17-r9 |
| Chainguard | azure-aad-pod-identity-nmi | 0 | 1.8.17-r9 |
| Chainguard | bank-vaults | 0 | 1.20.4-r13 |
| Chainguard | bank-vaults-fips | 0 | 1.20.4-r10 |
| Chainguard | bank-vaults-template | 0 | 1.20.4-r13 |
| Chainguard | bank-vaults-template-fips | 0 | 1.20.4-r10 |
| Chainguard | bom | 0 | 0.6.0-r5 |
| Chainguard | boring-registry | 0 | 0.14.0-r1 |
| Chainguard | boring-registry-fips | 0 | 0.14.0-r1 |
| Chainguard | buildctl | 0 | 0.13.2-r1 |
| Chainguard | buildkitd | 0 | 0.13.2-r1 |
| Chainguard | caddy | 0 | 2.7.6-r9 |
| Chainguard | caddy-fips | 0 | 2.7.6-r6 |
| Chainguard | caddy-man | 0 | 2.7.6-r9 |
| Chainguard | caddy-man | 0 | 2.7.6-r6 |
| Chainguard | caddy-src | 0 | 2.7.6-r9 |
| Chainguard | cadvisor | 0 | 0.49.1-r7 |
| Chainguard | cadvisor-compat | 0 | 0.49.1-r7 |
| Chainguard | cadvisor-fips | 0 | 0.49.1-r6 |
| Chainguard | calico-cni-fips-3.25-compat | 0 | 3.25.2-r6 |
| Chainguard | calico-cni-fips-compat | 0 | 0 |
| Chainguard | calico-fips | 0 | 0 |
| Chainguard | calico-fips-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-apiserver | 0 | 0 |
| Chainguard | calico-fips-apiserver-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-app-policy | 0 | 0 |
| Chainguard | calico-fips-app-policy-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-cni | 0 | 0 |
| Chainguard | calico-fips-cni-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-felix | 0 | 0 |
| Chainguard | calico-fips-felix-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-key-cert-provisioner | 0 | 0 |
| Chainguard | calico-fips-kube-controllers | 0 | 0 |
| Chainguard | calico-fips-kube-controllers-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-node | 0 | 0 |
| Chainguard | calico-fips-node-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-pod2daemon | 0 | 0 |
| Chainguard | calico-fips-pod2daemon-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-typha-client | 0 | 0 |
| Chainguard | calico-fips-typha-client-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calico-fips-typhad | 0 | 0 |
| Chainguard | calico-fips-typhad-3.25 | 0 | 3.25.2-r6 |
| Chainguard | calicoctl-fips | 0 | 0 |
| Chainguard | calicoctl-fips-3.25 | 0 | 3.25.2-r6 |
| Chainguard | capslock | 0 | 0.2.2-r2 |
| Chainguard | cass-operator-compat-fips | 0 | 1.20.0-r1 |
| Chainguard | cass-operator-fips | 0 | 1.20.0-r1 |
| Chainguard | cass-operator-fips-no-pvc-delete | 0 | 1.20.0-r1 |
| Chainguard | cass-operator-fips-no-pvc-delete-compat | 0 | 1.20.0-r1 |
| Chainguard | cert-exporter | 0 | 2.12.0-r5 |
| Chainguard | cert-exporter-fips | 0 | 2.12.0-r6 |
| Chainguard | cert-manager-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-1.12-acmesolver | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-1.12-cainjector | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-1.12-controller | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-1.12-webhook | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-1.13 | 0 | 1.13.6-r1 |
| Chainguard | cert-manager-1.13-acmesolver | 0 | 1.13.6-r1 |
| Chainguard | cert-manager-1.13-cainjector | 0 | 1.13.6-r1 |
| Chainguard | cert-manager-1.13-controller | 0 | 1.13.6-r1 |
| Chainguard | cert-manager-1.13-webhook | 0 | 1.13.6-r1 |
| Chainguard | cert-manager-1.14 | 0 | 1.14.5-r1 |
| Chainguard | cert-manager-1.14-acmesolver | 0 | 1.14.5-r1 |
| Chainguard | cert-manager-1.14-cainjector | 0 | 1.14.5-r1 |
| Chainguard | cert-manager-1.14-controller | 0 | 1.14.5-r1 |
| Chainguard | cert-manager-1.14-startupapicheck | 0 | 1.14.5-r1 |
| Chainguard | cert-manager-1.14-webhook | 0 | 1.14.5-r1 |
| Chainguard | cert-manager-acmesolver-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-acmesolver-1.12-bitnami-compat | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-acmesolver-1.12-iamguarded-compat | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-acmesolver-fips-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-cainjector-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-cainjector-1.12-bitnami-compat | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-cainjector-1.12-iamguarded-compat | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-cainjector-fips-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-controller-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-controller-1.12-bitnami-compat | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-controller-1.12-iamguarded-compat | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-controller-fips-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-fips-1.12 | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-fips-1.12-acmesolver | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-fips-1.12-cainjector | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-fips-1.12-cmctl | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-fips-1.12-controller | 0 | 1.12.10-r1 |
| Chainguard | cert-manager-fips-1.12-webhook | 0 | 1.12.10-r1 |
Related vulnerabilities
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects stdlib
- CVE-2025-22873 It was possible to improperly access the parent directory of an os.Root by opening a… Also affects stdlib
- GO-2026-4403 Improper access to parent directory of root in os Also affects stdlib
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects stdlib
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects stdlib
- CVE-2025-61730 During the TLS 1.3 handshake if multiple messages are sent in records that span… Also affects stdlib
- CVE-2025-61727 An excluded subdomain constraint in a certificate chain does not restrict the usage of… Also affects stdlib
- CVE-2025-61729 Within HostnameError.Error(), when constructing an error string, there is no limit to the… Also affects stdlib