CVE-2023-45288: net/http, x/net/http2: close connections when receiving too many headers
Summary
CVE-2023-45288: net/http, x/net/http2: close connections when receiving too many headers. Affects net/http across 2 version ranges.
< 1.21.9
>= 1.22.0-0, < 1.22.2
Fixed in 1.21.9 or 1.22.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-45288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/http package in Go provides a set of functions and types for building HTTP servers and clients. The x/net/http2 package is an extension to the net/http package that adds support for the HTTP/2 protocol. These packages are widely used in Go applications for handling HTTP communication.
Vulnerability Detail
An attacker can exploit a vulnerability in the net/http and x/net/http2 packages to cause an HTTP/2 endpoint to read excessive amounts of header data. By sending an excessive number of CONTINUATION frames, the attacker can force the endpoint to parse and process all the headers, even if they exceed the maximum allowed size. This can lead to the consumption of significant resources and potential denial-of-service attacks. The fix for this vulnerability limits the number of excess header frames that will be processed before closing the connection.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.21.91.21.9go get net/http@v1.21.9 -
>= 1.22.0-0, < 1.22.21.22.2go get net/http@v1.22.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing rate limiting or request filtering mechanisms to prevent excessive header sizes from reaching the vulnerable endpoints.
Conclusion
The net/http and x/net/http2 packages in Go are vulnerable to an issue that allows attackers to consume excessive resources by sending large amounts of header data. This can lead to denial-of-service attacks and performance degradation. Developers should update to the fixed versions mentioned in the 'how_to_fix' section and configure appropriate values for the MaxHeaderBytes parameter to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for net/http →
FAQ
This vulnerability allows an attacker to consume excessive resources on the target server by sending large amounts of header data. This can lead to denial-of-service attacks and potential performance degradation.
No, only versions prior to the fixed versions mentioned in the 'how_to_fix' section are affected. Developers should update to the latest fixed versions to mitigate the vulnerability.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity.
Yes, this vulnerability can be exploited remotely by sending specially crafted HTTP/2 requests to the target server.
There is no known public exploit for this vulnerability at the time of this report. However, it is advisable to apply the recommended fixes to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for net/http.
