This vulnerability (CVE-2024-45338) involves a flaw in golang.org/x/net/html where specially crafted input causes the parsing functions to operate in a non-linear manner relative to input length. This results in excessive CPU and memory consumption, leading to denial of service by resource exhaustion. The flaw is rated as Important by Red Hat and has a CVSS base score of 7.5 according to Red Hat's assessment. It affects Red Hat Developer Hub (RHDH) 1.4 and related components that use this package. Red Hat has released Red Hat Developer Hub 1.4.1 as a bug fix advisory that addresses this and other vulnerabilities. The advisory recommends upgrading to the latest version to mitigate the issue. No exploits in the wild are currently known. The vulnerability is associated with CWE-770 (Allocation of Resources Without Limits or Throttling).

An attacker can cause denial of service by submitting malicious input that triggers non-linear parsing in the golang.org/x/net/html package, leading to excessive CPU and memory usage. This can exhaust system resources, causing service disruption. There is no impact on confidentiality or integrity reported. The vulnerability affects availability by enabling resource exhaustion.

Red Hat recommends upgrading to Red Hat Developer Hub version 1.4.1 or later, which includes fixes for this vulnerability and other issues. No specific patches are linked, but upgrading to the latest version is advised. There are no vendor advisories indicating that no action is required or that the issue is already mitigated. Users should follow Red Hat's official guidance for updating affected products.