HTTP/2 CONTINUATION flood in net/http
Summary
CVE-2023-45288: HTTP/2 CONTINUATION flood in net/http. Affects stdlib across 2 version ranges.
< 1.21.9
>= 1.22.0-0, < 1.22.2
Fixed in 1.21.9 or 1.22.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- net/http · Go
- golang-1.15 · Debian:11
The same CVE-2023-45288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/http package is a part of the Go standard library and provides functionality for building HTTP servers and clients. It includes various functions for handling HTTP requests and responses, managing cookies, and configuring HTTP clients and servers. The vulnerability affects the HTTP/2 implementation in the net/http package.
Vulnerability Detail
An attacker can exploit this vulnerability by sending an excessive number of CONTINUATION frames to an HTTP/2 endpoint. This causes the endpoint to read arbitrary amounts of header data associated with a request that is going to be rejected. The headers can include Huffman-encoded data, which is more expensive for the receiver to decode than for the attacker to send. The issue arises because the net/http package continues to parse and process all headers and continuation frames even if the request's headers exceed the MaxHeaderBytes limit. This can lead to resource exhaustion and potential denial-of-service (DoS) attacks.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.21.91.21.9go get stdlib@v1.21.9 -
>= 1.22.0-0, < 1.22.21.22.2go get stdlib@v1.22.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the affected packages to the fixed versions.
Conclusion
The HTTP/2 CONTINUATION flood vulnerability in the net/http package can be exploited by an attacker to cause resource exhaustion and potential denial-of-service attacks. It is crucial to update the affected packages to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, potentially leading to resource exhaustion and denial-of-service attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the recommended fixes to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by sending specially crafted HTTP/2 requests to the affected endpoint.
There is no evidence of active exploitation of this vulnerability at the time of writing. However, it is still important to apply the recommended fixes to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
