CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html

December 18, 2024 (updated October 31, 2025)

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

References

cs.opensource.google/go/x/net
github.com/advisories/GHSA-w32m-9786-jp63
github.com/golang/go/issues/70906
go.dev/cl/637536
go.dev/issue/70906
groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
nvd.nist.gov/vuln/detail/CVE-2024-45338
pkg.go.dev/vuln/GO-2024-3333

Code Behaviors & Features

Detect and mitigate CVE-2024-45338 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →