CVE-2023-45288: Vulnerability in stdlib package - DoS via unlimited CONTINUATION frames
Summary
CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Affects golang-1.15 versions 1.15.15-1 – 1.15.9-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a standard library in the Go programming language. It provides a collection of packages that offer essential functionality for Go programs. The package includes various modules, such as net/http and x/net/http2, which are responsible for handling HTTP and HTTP/2 protocols. These modules are used extensively in web applications and services.
Vulnerability Detail
This vulnerability (CVE-2023-45288) affects the net/http and x/net/http2 modules in the stdlib package. By sending an excessive number of CONTINUATION frames, an attacker can cause an HTTP/2 endpoint to read arbitrary amounts of header data. This vulnerability arises due to the parsing and processing of all HEADERS and CONTINUATION frames on a connection, which can lead to memory exhaustion and denial-of-service (DoS) conditions. The excessive headers can include Huffman-encoded data, making it more resource-intensive for the receiver to decode than for the attacker to send.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the stdlib package to the fixed versions mentioned above.
Conclusion
The vulnerability in the stdlib package's net/http and x/net/http2 modules can lead to denial-of-service conditions by causing excessive memory consumption. To mitigate this risk, it is crucial to update the stdlib package to version 1.21.9 or 1.22.2. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability allows an attacker to consume excessive memory resources on an HTTP/2 endpoint, leading to denial-of-service conditions. This can result in service disruption and unavailability.
Applications that utilize the net/http and x/net/http2 modules from the stdlib package are potentially affected. It is recommended to check the installed version and update to the fixed versions.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2023-45288
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
