CVE-2024-24790

IPv4-mapped IPv6 addresses are a special format that allows IPv4 addresses to be represented in IPv6 address space (e.g., ::ffff:127.0.0.1 corresponds to 127.0.0.1). The Is* methods in the net/netip package did not treat these addresses the same as their pure IPv4 counterparts, so for example the address ::ffff:192.168.1.1 was not recognized as private. Applications relying on these functions to make security decisions could as a result incorrectly classify an address and allow access that should be blocked.

An attacker can bypass filters based on IP address classification (e.g., blocking private addresses, loopback, or link-local), which depending on the application may result in unauthorized access to resources, privilege escalation, or disclosure of sensitive data.

Apply patches available from the vendor according to the references (fix available at go.dev/cl/590316). It is recommended to update to the latest patched version of Go and review the code of applications using Is* methods in the context of IPv4-mapped IPv6 addresses.

Golang Go — versions indicated in the vendor references (see go.dev/issue/67680 and golang-announce mailing list)