VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jan 28, 2025· Updated Apr 15, 2026

CVE-2024-45341

CVE-2024-45341

Description

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2024-45341 allows a crafted certificate with an IPv6 zone ID in a URI to bypass URI name constraints in Go's crypto/x509, impacting private PKIs.

Vulnerability

Overview

CVE-2024-45341 is a vulnerability in Go's crypto/x509 package, reported by Juho Forsén of Mattermost [1][2][3][4]. The root cause is that when verifying URI name constraints in certificate chains, the parser incorrectly handles IPv6 addresses that include a zone ID (e.g., fe80::1%eth0). A certificate containing such a URI can falsely satisfy a URI name constraint, bypassing the intended validation [1][3][4].

Exploitation

Conditions

This vulnerability requires a private PKI that issues certificates with URIs, as certificates containing URIs are not permitted in the global web PKI [1][2]. An attacker who can obtain or craft a certificate with a URI containing an IPv6 address with a zone ID could exploit this bypass to cause the certificate to be accepted by a client that enforces URI name constraints [3][4]. No special network position is required beyond the ability to serve or inject such a certificate into a trusted chain.

Impact

Successful exploitation allows an attacker to bypass URI name constraints, potentially leading to unauthorized trust of a certificate that should have been rejected. In a private PKI context, this could enable man-in-the-middle attacks, impersonation of services, or other violations of the certificate policy [1][2][3].

Mitigation

Users are advised to update Go to versions 1.23.5, 1.22.11, or 1.24rc2 (and the later final 1.24 release), which contain the fix [1][2][3]. For private PKI deployments that rely on URI name constraints, review certificate issuance processes to ensure IPv6 zone IDs are not used in URIs. The vulnerability does not affect the public web PKI [1][2][3].

References
  1. [security] Go 1.24 Release Candidate 2 is released
  2. [security] Go 1.23.5 and Go 1.22.11 are released
  3. GO-2025-3373 - Go Packages
  4. crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341]

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2888

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.