CVE-2023-39325: golang/stdlib - Rapid Stream Resets Can Cause Excessive Work
Summary
CVE-2023-39325: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. Affects golang-1.15 versions < 8042fd87f37a725e34407994c9a11aaf95f5af45. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang/stdlib package is a standard library in the Go programming language. It provides a set of essential functions and utilities for various tasks, including networking, file handling, and more. This vulnerability affects version 1.18.2 of the package.
Vulnerability Detail
A malicious HTTP/2 client can exploit this vulnerability by rapidly creating requests and immediately resetting them. This can lead to excessive consumption of server resources. Although the total number of requests is limited by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. The fix for this vulnerability introduces a bound on the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. The default stream concurrency limit is 250 streams per HTTP/2 connection.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the golang/stdlib package to the fixed versions mentioned above.
Conclusion
The golang/stdlib package is vulnerable to a high-severity vulnerability that allows a malicious HTTP/2 client to consume excessive server resources. To mitigate this risk, it is crucial to update the package to version 1.20.10 or 1.21.3. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
This vulnerability allows a malicious HTTP/2 client to consume excessive server resources, potentially leading to denial-of-service attacks or performance degradation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes your manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to update the golang/stdlib package to mitigate the risk.
No, updating the golang/stdlib package to the fixed versions is the recommended solution. There are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2023-39325
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
