CVE-2023-39326: Denial of service via chunk extensions in net/http
Summary
CVE-2023-39326: Denial of service via chunk extensions in net/http. Affects stdlib across 2 version ranges.
< 1.20.12
>= 1.21.0-0, < 1.21.5
Fixed in 1.20.12 or 1.21.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-39326 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is the standard library package 'net/http' in the Go ecosystem. This package provides a set of functions and types for building HTTP servers and clients. It is widely used for developing web applications and handling HTTP requests and responses. The vulnerability affects the chunked encoding reader in the 'net/http' package, which is responsible for reading and decoding HTTP requests and responses that use the chunked transfer encoding.
Vulnerability Detail
The vulnerability allows a malicious HTTP sender to exploit chunk extensions, a little-used HTTP feature, to cause a receiver reading from a request or response body to read more bytes from the network than are actually in the body. This can lead to a denial of service (DoS) condition. Additionally, a malicious HTTP client can leverage this vulnerability to make a server automatically read a large amount of data (up to approximately 1GiB) when a handler fails to read the entire body of a request. The chunk extensions feature allows including additional metadata in a request or response body sent using the chunked encoding. However, the 'net/http' chunked encoding reader does not handle this metadata and discards it. An attacker can exploit this by inserting a large metadata segment with each transferred byte, causing the chunk reader to produce an error if the ratio of real body to encoded bytes becomes too small.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.20.121.20.12go get stdlib@v1.20.12 -
>= 1.21.0-0, < 1.21.51.21.5go get stdlib@v1.21.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that their application properly reads the entire body of a request, even if the handler does not require the data. This can help prevent the automatic reading of a large amount of data triggered by a malicious client.
Conclusion
In conclusion, the 'net/http' package in the Go ecosystem is vulnerable to a denial of service (DoS) attack through the exploitation of chunk extensions. It is crucial for developers to update their applications to use the patched versions of the package and ensure proper handling of request and response bodies. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can lead to a denial of service (DoS) condition by causing a receiver to read more bytes from the network than are actually in the body of a request or response. It can also result in a server automatically reading a large amount of data when a handler fails to read the entire body of a request.
To fix this vulnerability, update the 'net/http' package to version 1.20.12 or later, or version 1.21.5 or later. Make sure to update your application to use the patched versions of the package.
While there is no specific workaround mentioned, developers can mitigate the risk by ensuring their application properly reads the entire body of a request, even if the handler does not require the data.
Chunked encoding is an HTTP feature that allows sending a request or response body in a series of chunks. Each chunk is preceded by its size in hexadecimal format, followed by a CRLF (carriage return and line feed) sequence, and then the chunk data. Chunked encoding is useful when the total size of the body is unknown or when the body needs to be streamed.
Yes, the 'net/http' package is widely used in the Go ecosystem for building HTTP servers and clients. It is a core part of many web applications and frameworks.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
