Go standard library · net/http
The net/http package in the Go standard library has an HTTP/2 flaw in which header frames beyond the MaxHeaderBytes limit are still parsed and decoded, even though their memory is not retained. An unauthenticated remote attacker who can reach an HTTP/2 endpoint with no user interaction can send an excessive number of CONTINUATION frames, consuming server processing resources (and potentially making the server unresponsive) before the request is rejected.
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Public exploit code (PoC-in-GitHub) appeared 8 days after disclosure. No confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
4 packages in 1 ecosystem. Main package: net/http.
Upgrade to 1.22.2 or later
go get net/http@v1.22.2The first fix for CVE-2023-45288. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 1.22.0-0 up to 1.22.2 | 1.22.2 |
| All versions before 1.21.9 | 1.21.9 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.