Vulnerability Intelligence Report
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
CVE-2024-24790
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:1.95%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-180 ↗CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Go standard library | net/netip | 0 < 1.21.11 (affected), 1.22.0-0 < 1.22.4 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.952%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Go Project · Vendor · USA |
| Reserved | 2024-01-30T16:05:14 |
| Published | 2024-06-05T15:13:50 |
| Last Updated | 2025-02-13T17:40:28 |
Community Chatter & Buzz