GitHub Advisoryadvisory · Go

GHSA-hgr8-6h9x-f7q9 golang.org/x/net/http vulnerable to ping floods

HIGH Published 2022-05-24 Modified 2024-05-20 Official page ↗
Aliases
CVE-2019-9512
Ecosystem
Go
Packages
golang.org/x/net
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-02-08

Affected packages

• Go golang.org/x/net: < 0.0.0-20190813141303-74dc4d7220e7 → fixed in 0.0.0-20190813141303-74dc4d7220e7

Description

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. Specific Go Packages Affected golang.org/x/net/http2

Related

Alias · CVE (1)

  • CVE-2019-9512 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References