9.8 Critical

CVE-2024-24790 The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning…

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Affected products and versions

Product	Affected versions	Fixed in
net/netip 1.22	1.22.0-0 → < 1.22.4	1.22.4
net/netip 1.21	earliest → < 1.21.11	1.21.11
Go 1.22	1.22.0-0 → < 1.22.4	1.22.4
Go 1.21	earliest → < 1.21.11	1.21.11

References

go.dev go.dev
go.dev go.dev
groups.google.com groups.google.com
pkg.go.dev pkg.go.dev
www.openwall.com www.openwall.com

Timeline

Published June 5, 2024
Last modified February 13, 2025

Track this CVE