GitHub Advisoryadvisory · Go

GHSA-xrjj-mj9h-534m golang.org/x/net/http2 vulnerable to possible excessive memory growth

MEDIUM Published 2022-12-08 Modified 2024-05-20 Official page ↗
Aliases
CVE-2022-41717
Ecosystem
Go
Packages
golang.org/x/net/http2, golang.org/x/net
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770
Reviewed
2023-01-18

Affected packages

• Go golang.org/x/net/http2: < 0.4.0 → fixed in 0.4.0 • Go golang.org/x/net: < 0.4.0 → fixed in 0.4.0

Description

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Related

Alias · CVE (1)

  • CVE-2022-41717 An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References