CVE-2024-45340

8.8 highEPSS 0.7%

High (8.8). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in toolchain 1.24.0-rc.2.

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
Published: 2025-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2025-3383	Go	toolchain	>=1.24.0-0 <1.24.0-rc.2	1.24.0-rc.2

References

https://go.dev/cl/643097
https://go.dev/issue/71249
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
https://pkg.go.dev/vuln/GO-2025-3383

Check your stack JSON