golang.org/x/net/http vulnerable to a reset flood
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated May 20, 2024
Package
Affected versions
< 0.0.0-20190813141303-74dc4d7220e7
Patched versions
0.0.0-20190813141303-74dc4d7220e7
Description
Published by the National Vulnerability Database
Aug 13, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Feb 8, 2023
Last updated
May 20, 2024
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Specific Go Packages Affected
golang.org/x/net/http2
References