golang.org/x/net/http2/h2c vulnerable to request smuggling attack
High severity
GitHub Reviewed
Published
Jan 14, 2023
to the GitHub Advisory Database
•
Updated May 20, 2024
Package
Affected versions
>= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862
Patched versions
0.1.1-0.20221104162952-702349b0e862
Description
Published by the National Vulnerability Database
Jan 13, 2023
Published to the GitHub Advisory Database
Jan 14, 2023
Reviewed
Jan 20, 2023
Last updated
May 20, 2024
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Specific Go Packages Affected
golang.org/x/net/http2/h2c
References