Medium severity · published Jan 28, 2025
CVE-2024-45341
Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
crypto/x509 · Go standard library
before 1.22.11; 1.23.0-0 before 1.23.5; 1.24.0-0 before 1.24.0-rc.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45341
go.dev
https://go.dev/cl/643099
go.dev
https://go.dev/issue/71156
groups.google.com
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
groups.google.com
https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
pkg.go.dev
https://pkg.go.dev/vuln/GO-2025-3373
security.netapp.com
https://security.netapp.com/advisory/ntap-20250221-0004/
More from crypto/x509
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
7.5
CVE-2026-32280
Unexpected work during chain building in crypto/x509
7.5
CVE-2026-32281
Inefficient policy validation in crypto/x509
7.5
CVE-2026-27137
Incorrect enforcement of email constraints in crypto/x509
7.5
CVE-2025-61729
Excessive resource consumption when printing error string for host certificate validation in crypto/x509