CVE-2024-24789: Mishandling of corrupt central directory record in archive/zip
Summary
CVE-2024-24789: Mishandling of corrupt central directory record in archive/zip. Affects stdlib across 2 version ranges.
< 1.21.11
>= 1.22.0-0, < 1.22.4
Fixed in 1.21.11 or 1.22.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2024-24789 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The archive/zip package is a part of the Go standard library and provides functionality for reading and writing ZIP archives. It is widely used in Go applications for compressing and decompressing files. However, a vulnerability has been discovered in the package that affects its handling of certain types of invalid zip files. This vulnerability could be exploited to create a zip file with contents that vary depending on the implementation reading the file.
Vulnerability Detail
The mishandling of corrupt central directory records in the archive/zip package can lead to inconsistent behavior when reading zip files. This means that different implementations of the package may interpret the same zip file differently, potentially resulting in data corruption or other security issues. The package has been updated to reject files containing these errors, mitigating the vulnerability.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.21.111.21.11go get stdlib@v1.21.11 -
>= 1.22.0-0, < 1.22.41.22.4go get stdlib@v1.22.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to a fixed version of the archive/zip package as soon as possible.
Conclusion
The mishandling of corrupt central directory records in the archive/zip package can lead to inconsistent behavior and potential security issues when reading zip files. It is crucial for developers to update to a fixed version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability could lead to data corruption or other security issues when reading zip files using the archive/zip package. It is important to update to a fixed version to prevent potential exploitation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and the tool will analyze it for any vulnerable dependencies.
There are no known exploits for this vulnerability at the moment. However, it is always recommended to update to a fixed version to mitigate any potential risks.
No, manual fixes are not recommended for this vulnerability. It is best to update to a fixed version of the archive/zip package to ensure the proper handling of zip files.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2024-2888.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
