Denial of Service Vulnerability in golang

Background

The golang package is a popular open-source programming language that provides a robust development environment for building efficient and scalable applications. It is widely used for its simplicity, performance, and extensive standard library. However, the package is vulnerable to a Denial of Service (DoS) attack due to mishandling of the "Expect: 100-continue" header in the net/http HTTP/1.1 client.

Vulnerability Detail

The net/http HTTP/1.1 client in golang mishandles the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling can lead to an invalid state in the client connection, causing the next request sent on the connection to fail. An attacker can exploit this vulnerability by sending "Expect: 100-continue" requests to a net/http/httputil.ReverseProxy proxy, eliciting non-informational responses from the backend. Each request leaves the proxy with an invalid connection, resulting in subsequent requests using that connection to fail. This can lead to a denial of service.

Workaround

As a workaround, you can disable the use of the "Expect: 100-continue" header in the net/http client by setting the Transport.ExpectContinueTimeout field to a negative value. This can be done using the following code snippet:

package main

import (
	"net/http"
	"time"
)

func main() {
	client := &http.Client{
		Transport: &http.Transport{
			ExpectContinueTimeout: -1,
		},
	}
	// Make requests using the client
}

Conclusion

The golang package is vulnerable to a Denial of Service (DoS) attack due to mishandling of the "Expect: 100-continue" header. This can lead to invalid connections and subsequent request failures, causing service disruption. It is crucial to update the package to version 1.22.5 or higher to mitigate this vulnerability.

See every vulnerability recorded for golang →

FAQ