CVE-2024-24790: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
Summary
CVE-2024-24790: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip. Affects stdlib across 2 version ranges.
< 1.21.11
>= 1.22.0-0, < 1.22.4
Fixed in 1.21.11 or 1.22.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2024-24790 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem provides a set of standard libraries for the Go programming language. One of the packages within stdlib is net/netip, which offers functionality for working with IP addresses. This vulnerability affects the Is methods in net/netip when dealing with IPv4-mapped IPv6 addresses. These methods, such as IsPrivate, IsLoopback, etc., do not behave as expected for IPv4-mapped IPv6 addresses, incorrectly returning false instead of true for addresses that would be considered true in their traditional IPv4 forms.
Vulnerability Detail
The Is methods in net/netip fail to correctly identify the properties of IPv4-mapped IPv6 addresses. This can lead to unexpected behavior and incorrect assumptions about the nature of these addresses. For example, an address that should be recognized as private or loopback may be mistakenly classified as non-private or non-loopback. This vulnerability can potentially impact applications that rely on the Is methods to make decisions based on IP address properties. It is important to note that this vulnerability only affects IPv4-mapped IPv6 addresses and not other types of IP addresses.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.21.111.21.11go get stdlib@v1.21.11 -
>= 1.22.0-0, < 1.22.41.22.4go get stdlib@v1.22.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can manually check the properties of IPv4-mapped IPv6 addresses using alternative methods or by converting them to their traditional IPv4 forms before applying the Is methods.
Conclusion
The vulnerability in the Is methods of net/netip for IPv4-mapped IPv6 addresses can lead to unexpected behavior and incorrect assumptions about IP address properties. It is crucial for developers to update their Go version to 1.21.11 or later, or 1.22.4 or later, to ensure the correct functioning of these methods. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability affects Go versions prior to 1.21.11 and 1.22.4.
The impact of this vulnerability depends on how applications utilize the Is methods in net/netip. It can lead to incorrect decisions based on IP address properties, potentially affecting security or functionality.
No, only the Is methods in net/netip specifically targeting IPv4-mapped IPv6 addresses are affected. Other types of IP addresses are not impacted.
While there is no specific workaround provided, developers can manually check the properties of IPv4-mapped IPv6 addresses using alternative methods or by converting them to their traditional IPv4 forms before applying the Is methods.
To fix this vulnerability, update your Go version to 1.21.11 or later, or 1.22.4 or later. These versions include the necessary fixes for the Is methods in net/netip.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
