An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
History

Fri, 21 Feb 2025 18:45:00 +0000

Type Values Removed Values Added
References

Tue, 18 Feb 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat cluster Observability Operator
CPEs cpe:/a:redhat:cluster_observability_operator:1.0::el8
Vendors & Products Redhat cluster Observability Operator

Fri, 14 Feb 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhdh
CPEs cpe:/a:redhat:advanced_cluster_security:4.4::el8
cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift_ai:2.17::el8
cpe:/a:redhat:rhdh:1.4::el9
Vendors & Products Redhat rhdh

Thu, 13 Feb 2025 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat gatekeeper
CPEs cpe:/a:redhat:gatekeeper:3.14::el9
cpe:/a:redhat:gatekeeper:3.15::el9
cpe:/a:redhat:gatekeeper:3.17::el9
Vendors & Products Redhat gatekeeper

Thu, 13 Feb 2025 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat cert Manager
Redhat container Native Virtualization
Redhat cryostat
Redhat multicluster Engine
Redhat multicluster Globalhub
Redhat openshift
Redhat openshift Ai
Redhat openshift Builds
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat openshift Distributed Tracing
Redhat service Mesh
Redhat trusted Artifact Signer
Redhat trusted Profile Analyzer
CPEs cpe:/a:redhat:acm:2.10::el9
cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.12::el9
cpe:/a:redhat:acm:2.9::el8
cpe:/a:redhat:advanced_cluster_security:4.5::el8
cpe:/a:redhat:advanced_cluster_security:4.6::el8
cpe:/a:redhat:cert_manager:1.15::el9
cpe:/a:redhat:container_native_virtualization:4.17::el9
cpe:/a:redhat:cryostat:3::el8
cpe:/a:redhat:multicluster_engine:2.4::el8
cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
cpe:/a:redhat:multicluster_globalhub:1.2::el9
cpe:/a:redhat:multicluster_globalhub:1.3::el9
cpe:/a:redhat:openshift:4.12::el8
cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.15::el8
cpe:/a:redhat:openshift:4.15::el9
cpe:/a:redhat:openshift:4.16::el9
cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:openshift_ai:2.16::el8
cpe:/a:redhat:openshift_builds:1.1::el9
cpe:/a:redhat:openshift_builds:1.2::el9
cpe:/a:redhat:openshift_data_foundation:4.16::el9
cpe:/a:redhat:openshift_data_foundation:4.17::el9
cpe:/a:redhat:openshift_devspaces:3::el9
cpe:/a:redhat:openshift_distributed_tracing:3.4::el8
cpe:/a:redhat:service_mesh:2.4::el8
cpe:/a:redhat:service_mesh:2.5::el8
cpe:/a:redhat:service_mesh:2.6::el9
cpe:/a:redhat:trusted_artifact_signer:1.1::el9
cpe:/a:redhat:trusted_profile_analyzer:1.2::el9
Vendors & Products Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat cert Manager
Redhat container Native Virtualization
Redhat cryostat
Redhat multicluster Engine
Redhat multicluster Globalhub
Redhat openshift
Redhat openshift Ai
Redhat openshift Builds
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat openshift Distributed Tracing
Redhat service Mesh
Redhat trusted Artifact Signer
Redhat trusted Profile Analyzer

Tue, 31 Dec 2024 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1333
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}


Sat, 21 Dec 2024 02:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important


Wed, 18 Dec 2024 20:45:00 +0000

Type Values Removed Values Added
Description An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Title Non-linear parsing of case-insensitive content in golang.org/x/net/html
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-02-21T18:03:32.301Z

Reserved: 2024-08-27T19:41:58.555Z

Link: CVE-2024-45338

cve-icon Vulnrichment

Updated: 2025-02-21T18:03:32.301Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-12-18T21:15:08.173

Modified: 2025-02-21T18:15:17.717

Link: CVE-2024-45338

cve-icon Redhat

Severity : Important

Publid Date: 2024-12-18T20:38:22Z

Links: CVE-2024-45338 - Bugzilla