go1.22 (SUSE:Linux Enterprise Module for Development Tools 15 SP6) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Development Tools 15 SP6 package go1.22, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (9)

• CVE-2024-24790 — CVSS 9.8 (critical): The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses…
• CVE-2024-24791 — CVSS 7.5 (high): The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a…
• CVE-2024-34156 — CVSS 7.5 (high): Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up…
• CVE-2024-34158 — CVSS 7.5 (high): Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
• CVE-2024-45336 — CVSS 6.1 (medium): The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an…
• CVE-2024-45341 — CVSS 6.1 (medium): A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the…
• CVE-2024-24789 — CVSS 5.5 (medium): The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This…
• CVE-2024-34155 — CVSS 4.3 (medium): Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
• CVE-2025-22866 — CVSS 4.0 (medium): Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret…