net/http, x/net/http2: Denial of Service vulnerabilities in the HTTP/2 implementation

[FiloSottile]

net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. Servers will now close connections if the send queue accumulates too many control messages.

Thanks to Jonathan Looney from Netflix for discovering and reporting these issues.

These issues are CVE-2019-9512 and CVE-2019-9514.

[dmitshur]

@gopherbot Please backport this to 1.12 and 1.11. This was a security problem.

[gopherbot]

Backport issue(s) opened: #33630 (for 1.11), #33631 (for 1.12).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

[gopherbot]

Change https://golang.org/cl/190137 mentions this issue: net/http: update bundled golang.org/x/net/http2 to import security fix