CVE Catalog
CVE-2024-24790
CriticalSummary
A vulnerability in the Go standard library (net/netip) causes IsPrivate, IsLoopback, and similar methods to mishandle IPv4-mapped IPv6 addresses, returning false for addresses that would return true in their traditional IPv4 forms.
Risk Assessment
The organization may misclassify network traffic, leading to bypass of security rules, e.g., allowing loopback or private addresses that should be blocked.
Recommendation
Update the Go library to a patched version (e.g., Go 1.22.2 or later) and rebuild applications using IsPrivate/IsLoopback methods on IPv4-mapped IPv6 addresses.
Original NVD description (English source)
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.