CVE-2024-1394

CVE-2024-1394 is a memory leak vulnerability in the Golang RSA encryption/decryption code, specifically within the github.com/golang-fips/openssl/openssl/rsa.go#L113 function. This flaw allows an attacker to trigger resource exhaustion by providing specially crafted inputs, as the pkey and ctx objects are not properly freed in error handling paths. Rated with a CVSS score of 7.5 (HIGH), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, leading to high availability impact. There is no confidentiality or integrity impact. Currently, there is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public awareness.