CVE-2023-39326: Denial of Service (DoS) via Resource Consumption in stdlib
Summary
CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. Affects golang-1.15 versions < 97c8ff8d53759e7a82b1862403df1694f2b6e073. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a standard library that provides a collection of packages for various functionalities in the Go programming language. It includes essential modules for networking, file handling, cryptography, and more. The package is widely used in Go applications and is a fundamental component of the language's ecosystem. However, a vulnerability has been discovered in the net/http/internal module of stdlib, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in the net/http/internal module of stdlib allows a malicious HTTP sender to exploit chunk extensions to cause excessive resource consumption on the receiver's side. By sending specially crafted requests or responses with large metadata segments, an attacker can trick the chunked encoding reader into reading more data from the network than necessary. This can result in a server automatically reading a significant amount of data, up to approximately 1GiB, when a request handler fails to read the entire body. Chunk extensions are a rarely used feature in HTTP that allows additional metadata to be included in chunked encoded requests or responses. The net/http chunked encoding reader does not handle this metadata properly, leading to the vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the stdlib package to the patched versions.
Conclusion
The stdlib package in Go is susceptible to a Denial of Service (DoS) vulnerability in the net/http/internal module. By exploiting chunk extensions, an attacker can cause excessive resource consumption on the server-side. To mitigate this vulnerability, it is essential to update the stdlib package to versions 1.20.12 or 1.21.5. Developers should also ensure that all dependencies are updated accordingly. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability allows an attacker to cause excessive resource consumption on the server-side, potentially leading to a Denial of Service (DoS) condition. This can result in degraded performance or unavailability of affected services.
Yes, the vulnerability can be exploited remotely by sending malicious requests or responses to the affected server.
No, only versions 1.18.2 of stdlib are affected. Updating to versions 1.20.12 or 1.21.5 will fix the vulnerability.
Yes, the CVSS score for this vulnerability is 5.3, indicating a medium severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
