CVE-2023-24534: Denial of Service Vulnerability in stdlib
Summary
CVE-2023-24534: HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Affects golang-1.15 versions < ca305e101d89969b5cc6a812b1f12038b769aaa2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language (golang) and provides a collection of standard libraries for various functionalities. It includes modules for HTTP and MIME header parsing, among others. These libraries are widely used in Go applications for handling network communication and data parsing.
Vulnerability Detail
The vulnerability identified as CVE-2023-24534 affects the net/http and net/textproto modules in the stdlib package. It arises from a flaw in the header parsing function, which can lead to excessive memory allocation. Even when parsing small inputs, the function may allocate large amounts of memory, potentially causing a denial of service (DoS) condition. An attacker can exploit this behavior by sending specially crafted requests to an HTTP server, causing it to allocate more memory than necessary and potentially exhausting system resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fixed versions of the stdlib package to mitigate the risk of a DoS attack.
Conclusion
The CVE-2023-24534 vulnerability in the stdlib package of the Go programming language can lead to a denial of service condition due to excessive memory allocation during header parsing. It is crucial for developers to update their Go installations and rebuild affected applications using the fixed versions of the stdlib package (1.19.8 or 1.20.3) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can be exploited to cause a DoS condition on an HTTP server by consuming excessive memory. This can lead to degraded performance or even a complete system crash.
Yes, an attacker can exploit this vulnerability remotely by sending specially crafted requests to an HTTP server.
No, only versions up to and including 1.18.2 are affected. The vulnerability has been fixed in versions 1.19.8 and 1.20.3.
There is no known instance of this vulnerability being actively exploited at the time of this report. However, it is crucial to apply the fix to prevent potential attacks.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2023-24534
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
