Unbounded Memory Usage Vulnerability in github.com/spiffe/spire
Summary
GHSA-m7vp-hqwv-7m5x: Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints. Affects github.com/spiffe/spire across 2 version ranges.
< 1.0.3
>= 1.1.0, < 1.1.3
Fixed in 1.0.3 or 1.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/spiffe/spire package is written in Go and is used as a server and agent for the SPIFFE (Secure Production Identity Framework For Everyone) project. It provides functionality for OIDC Discovery Provider, K8s Workload Registrar in webhook mode, and SPIRE server bundle endpoint. The package relies on the net/http Go package, which has a vulnerability that allows attacker-controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints.
Vulnerability Detail
The vulnerability, tracked under CVE-2021-44716, affects HTTP/2 endpoints in the github.com/spiffe/spire package that use the net/http package. It allows an attacker to consume unbounded memory by sending specially crafted HTTP/2 requests. This vulnerability does not affect gRPC endpoints in the package, as they use their own HTTP/2 implementation. The vulnerable endpoints in SPIRE server and agent include OIDC Discovery Provider, K8s Workload Registrar in webhook mode, and the SPIRE server bundle endpoint. However, endpoints such as the SPIRE server/agent metrics endpoint for Prometheus, health endpoints, and profiling endpoints are not vulnerable as they do not have HTTP/2 support enabled on non-TLS protected endpoints.
How To Fix
Latest published version: v1.15.5 as of 23 Oct 2026
go get github.com/spiffe/spire@v1.15.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.0.31.0.3go get github.com/spiffe/spire@v1.0.3 -
>= 1.1.0, < 1.1.31.1.3go get github.com/spiffe/spire@v1.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to disable HTTP/2 support on all non-gRPC endpoints by setting the GODEBUG environment variable with the value http2server=0. This can be done by adding the following line to the environment configuration:
export GODEBUG=http2server=0
Conclusion
The vulnerability in the github.com/spiffe/spire package has been addressed in SPIRE versions 1.0.3 and 1.1.3. Users are advised to upgrade to these versions to fix the vulnerability. Alternatively, the vulnerability can be mitigated by disabling HTTP/2 support on non-gRPC endpoints using the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/spiffe/spire →
FAQ
SPIRE versions 0.0.1 to 1.0.2 are affected by this vulnerability.
No, gRPC endpoints in SPIRE are not affected by this vulnerability as they use their own HTTP/2 implementation.
Yes, the risk associated with this vulnerability can be somewhat mitigated by disabling vulnerable components or endpoints that are optionally configured.
Yes, the vulnerability can be worked around entirely by disabling HTTP/2 support on all non-gRPC endpoints using the GODEBUG environment variable as mentioned in the workaround section.
There are no known exploits of this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/spiffe/spire.
