CVE-2024-1394 · AETERNAE Research

Disclosure summary

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.

Source-reported weakness categories

CWE-401

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2024-1394

Open original source · Updated Oct 08, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

Original records & references

PUBLISHED 2024-03-21T09:00:08-04:00
MODIFIED 2026-10-08T07:16:40-04:00
INGESTED 2026-10-08T12:30:36-04:00

CVE-2024-1394.

Disclosure summary

Source-reported weakness categories

Source-specific records & product guidance

Original records & references