Skip to content

CanonicalHeaderKey security vulnerability  #1080

@ghost

Description

An attacker can use memoization in the function http.CanonicalHeaderKey to consume an
arbitrarily large amount of memory in the Go HTTP server.

To reproduce send, requests with large numbers of headers in the format <large
prefix><incrementing counter>.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions