CVE-2024-24792: Image Parsing DOS Vulnerability

CVE-2024-24792 Overview

CVE-2024-24792 affects the Go standard library's image decoding functionality. Parsing a corrupt or malicious image that contains invalid color indices triggers a panic in the decoder. Attackers can deliver crafted images to any Go application that processes untrusted image input, causing the program to crash. The flaw is tracked upstream as GO-2024-2937 and was addressed in the Go project's image handling code.

The vulnerability is network-exploitable, requires no authentication, and impacts availability through a denial-of-service condition. Confidentiality and integrity remain unaffected.

Critical Impact
Remote attackers can crash Go-based services by submitting malformed images with invalid color index values, producing a denial-of-service condition without authentication or user interaction.

Affected Products

Go standard library image package (versions prior to the fix in change list 588115)
Go applications that decode untrusted image input using the affected package
Downstream tools and services that depend on the vulnerable Go image decoder

Discovery Timeline

2024-06-27 - CVE-2024-24792 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-24792

Vulnerability Analysis

The vulnerability is a denial-of-service flaw in Go's image parsing code. When the decoder encounters an image that references color palette indices outside the valid range, the runtime panics instead of returning an error. A panic in a goroutine that is not recovered propagates and terminates the process, taking down the hosting service.

Applications that accept user-supplied images are the primary attack surface. These include web servers performing thumbnail generation, content management systems, image conversion APIs, and any backend that calls Go's image decoders on untrusted bytes. A single malformed file is enough to disrupt processing pipelines.

The Exploit Prediction Scoring System places this issue at 0.731 percent, reflecting the limited impact beyond availability. However, repeated submissions can sustain an outage across services that automatically restart.

Root Cause

The root cause is missing input validation on color index values during image decoding. The decoder dereferences palette entries using attacker-controlled indices without verifying they fall within the palette's bounds. When an index exceeds the palette length, Go's runtime triggers a bounds-check panic.

This pattern aligns with improper input validation and out-of-bounds read behaviors. Further technical context is available in the Go.dev Issue Discussion and the Go.dev Vulnerability Report GO-2024-2937.

Attack Vector

The attacker prepares an image file containing invalid color index references and submits it to any endpoint that decodes images using the vulnerable Go package. No authentication, privileges, or user interaction are required. The decoder reads the malicious index, attempts the palette lookup, and panics. If the panic is not recovered by the calling code, the entire process exits.

The vulnerability is described in prose only because no verified proof-of-concept code is published in the referenced advisory material.

Detection Methods for CVE-2024-24792

Indicators of Compromise

Unexpected process termination or panic stack traces referencing the Go image decoding call path in application logs
Repeated HTTP requests delivering image payloads followed by abrupt service restarts or runtime error: index out of range messages
Spikes in 5xx responses or connection resets from endpoints that accept image uploads

Detection Strategies

Inspect application logs for Go runtime panic traces originating in image decoding functions
Correlate image upload requests with subsequent service crashes or container restarts
Use binary scanning tools such as govulncheck to identify builds linked against vulnerable Go versions

Monitoring Recommendations

Track process uptime and crash counters for services that handle untrusted images
Alert on elevated rates of malformed image submissions at the web application firewall or ingress layer
Monitor the Go toolchain version used in CI/CD pipelines and flag builds that fall behind the fixed release

How to Mitigate CVE-2024-24792

Immediate Actions Required

Upgrade Go to a release that includes the fix referenced in Go.dev Change Log Entry 588115 and rebuild affected binaries
Inventory services that decode untrusted images and prioritize them for redeployment
Run govulncheck against production binaries to confirm the vulnerable code path is no longer reachable

Patch Information

The fix is published in the Go project. Rebuild applications against a patched Go toolchain and redeploy. The change is documented in Go.dev Change Log Entry 588115 and tracked under GO-2024-2937.

Workarounds

Wrap image decoding calls in functions that use recover() to contain panics and prevent process termination
Validate image headers and reject files that exceed expected dimensions or palette sizes before decoding
Restrict image upload endpoints with authentication, rate limiting, and content-type enforcement until the patched build is deployed

bash

# Verify Go toolchain and scan binaries for the vulnerability
go version
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...