CVE-2024-1394Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 22 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-401
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Deferred
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 redhat:ansible_automation_platform | from 0:1.4.5-1.el8ap not affected | CNA record |
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 redhat:ansible_automation_platform_developer | from 0:1.4.5-1.el8ap not affected | CNA record |
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 redhat:ansible_automation_platform_inside | from 0:1.4.5-1.el8ap not affected | CNA record |
Red Hat Red Hat Developer Tools redhat:devtools | from 0:1.19.13-6.el7_9 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | from 8090020240313170136.26eb71ac not affected | CNA record |
from 2:4.2.0-4.el9_0 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support redhat:rhel_eus | from 0:1.19.13-7.el9_2 not affected | CNA record |
Red Hat Red Hat OpenShift Container Platform 4.12 redhat:openshift | from 1:1.23.4-5.2.rhaos4.12.el8 not affected | CNA record |
Red Hat Red Hat OpenStack Platform 16.2 redhat:openstack | from 0:3.3.23-16.el8ost not affected | CNA record |
Red Hat RHODF-4.16-RHEL-9 redhat:openshift_data_foundation | from v4.16.0-137 not affected | CNA record |
Red Hat NBDE Tang Server redhat:network_bound_disk_encryption_tang | 1 | CNA record |
Red Hat OpenShift Developer Tools and Services redhat:ocp_tools | All versions | CNA record |
Red Hat OpenShift Pipelines redhat:openshift_pipelines | 1 | CNA record |
Red Hat OpenShift Serverless redhat:serverless | 1 | CNA record |
Red Hat Red Hat Certification for Red Hat Enterprise Linux 8 redhat:certifications | 1 | CNA record |
Red Hat Red Hat Openshift Container Storage 4 redhat:openshift_container_storage | 4 | CNA record |
Red Hat Red Hat OpenShift Dev Spaces redhat:openshift_devspaces | 3 | CNA record |
Red Hat Red Hat OpenShift GitOps redhat:openshift_gitops | 1 | CNA record |
Red Hat Red Hat OpenShift on AWS redhat:openshift_service_on_aws | 1 | CNA record |
Red Hat Red Hat OpenShift Virtualization 4 redhat:container_native_virtualization | 4 | CNA record |
Red Hat Red Hat Service Interconnect 1 redhat:service_interconnect | 1 | CNA record |
Red Hat Red Hat Software Collections redhat:rhel_software_collections | 3 | CNA record |
Red Hat Red Hat Storage 3 redhat:storage | 3 | CNA record |
References
- https://access.redhat.com/errata/RHSA-2024:1462vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1468vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1472vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1501vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1502vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1561vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1563vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1566vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1567vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1574vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1640vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1644vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1646vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1763vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:1897vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:2562vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:2568vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:2569vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:2729vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:2730vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:2767vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:3265vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:3352vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:4146vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2024:4371vendor-advisory, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.