CVE-2024-24788
Assigner: Go
Published: 2024-05-08T15:31:11.619Z
State: PUBLISHED
title: Malformed DNS message can cause infinite loop in net
descriptions: value: A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
affected: vendor: Go standard library
product: net
collectionURL: https://pkg.go.dev
packageName: net
versions: version: 1.22.0-0
lessThan: 1.22.3
status: affected
versionType: semver
programRoutines: extractExtendedRCode
Dial
DialTimeout
Dialer.Dial
Dialer.DialContext
Listen
ListenConfig.Listen
ListenConfig.ListenPacket
ListenPacket
LookupAddr
LookupCNAME
LookupHost
LookupIP
LookupMX
LookupNS
LookupSRV
LookupTXT
ResolveIPAddr
ResolveTCPAddr
ResolveUDPAddr
Resolver.LookupAddr
Resolver.LookupCNAME
Resolver.LookupHost
Resolver.LookupIP
Resolver.LookupIPAddr
Resolver.LookupMX
Resolver.LookupNS
Resolver.LookupNetIP
Resolver.LookupSRV
Resolver.LookupTXT
defaultStatus: unaffected
problemTypes: descriptions: description: CWE 400: Uncontrolled Resource Consumption
credits: value: @long-name-let-people-remember-you
value: Mateusz Poliwczak