CVE-2024-24789medium

CVE-2024-24789: medium-severity vulnerability in Go standard library archive/zip

Mishandling of corrupt central directory record in archive/zip

Published · Updated

Follow this CVE+ Monitor archive/zip+ Monitor go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
Go standard library · archive/zip
Related CVEs — Go standard library archive/zip

In the same product, most dangerous first.

CVE-2025-61728MEDIUMExcessive CPU consumption when building archive index in archive/zipEPSS 0.7%