VDB

GO-2024-3311

GO-2024-3311 PUBLISHED

Record from OSV · Published December 9, 2024

github.com/moby/moby is fixed in 26.1.0+incompatible (Go Modules)

NULL Pointer Dereference on moby image history in github.com/moby/moby

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/moby/mobyGo Modules26.1.0+incompatible
amazon-cloudwatch-agent-operatorWolfi3.3.0-r1
promxyChainguard0.0.93-r4
pulumiChainguard3.142.0-r1
amazon-cloudwatch-agent-operator-fipsChainguard3.3.0-r1
promxyWolfi0.0.93-r4
vault-1.17Chainguard1.17.6-r18
prometheus-2.51Chainguard2.51.2-r48
vault-1.16Chainguard1.16.3-r26
pulumiWolfi3.142.0-r1
promxy-fipsChainguard0.0.93-r4
amazon-cloudwatch-agent-operatorChainguard3.3.0-r1

Affected products

VendorProductVersions
wolfiamazon-cloudwatch-agent-operator0
chainguardpromxy0
chainguardpulumi0
github.commoby/moby25.0.0+incompatible
chainguardamazon-cloudwatch-agent-operator-fips0
wolfipromxy0
chainguardvault-1.170
chainguardprometheus-2.510
chainguardvault-1.160
wolfipulumi0
chainguardpromxy-fips0
chainguardamazon-cloudwatch-agent-operator0

Timeline

  • Dec 9, 2024 CVE Published
  • Feb 4, 2026 CVE Updated
  • May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GO-2024-3311
vulnetix vdb fixes GO-2024-3311

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2024-3311/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›