{"id":"CVE-2023-39325","aliases":["GHSA-4374-p667-p6c8","BIT-golang-2023-39325","GO-2023-2102"],"title":"HTTP/2 rapid reset can cause excessive work in net/http","summary":"HTTP/2 rapid reset can cause excessive work in net/http","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"x","product":"golang.org/x/net","ecosystem":"go","affected":["golang.org/x/net < 0.17.0"],"patched":["golang.org/x/net 0.17.0"],"published":"2023-10-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:24.714188558Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4374-p667-p6c8","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325"},{"url":"https://github.com/golang/go/issues/63417"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV"},{"url":"https://pkg.go.dev/vuln/GO-2023-2102"},{"url":"https://security.gentoo.org/glsa/202311-09"},{"url":"https://security.netapp.com/advisory/ntap-20231110-0008"},{"url":"https://go.dev/cl/534215"},{"url":"https://go.dev/cl/534235"},{"url":"https://go.dev/issue/63417"},{"url":"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z"},{"url":"golang.org/x/net"}],"tags":["osv","go","exploit-available"],"epss":0.03796,"epssPercentile":0.89615,"exploits":{"github":1,"githubRepos":["https://github.com/eilam-cell/cve-test-coredns-fork"],"checkedAt":"2026-09-27T10:33:28.944Z"},"exploitAvailable":true,"ingestedAt":"2026-07-23T19:05:53.961Z","slug":"CVE-2023-39325","body":"## Overview\n\nA malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. \n\nWith the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. \n\nThis issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.\n\nThe default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.\n\n## Affected packages\n\n- `golang.org/x/net < 0.17.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/net 0.17.0`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.8,"exploitation":12,"ransomware":0},"changes":[{"seq":201391,"id":"CVE-2023-39325","ts":1789399361080,"field":"cvss","old":null,"new":"7.5"},{"seq":201390,"id":"CVE-2023-39325","ts":1789399361080,"field":"severity","old":"none","new":"high"},{"seq":200130,"id":"CVE-2023-39325","ts":1789396666788,"field":"cvss","old":"7.5","new":null},{"seq":200129,"id":"CVE-2023-39325","ts":1789396666788,"field":"severity","old":"high","new":"none"},{"seq":196926,"id":"CVE-2023-39325","ts":1789384228760,"field":"cvss","old":null,"new":"7.5"},{"seq":196925,"id":"CVE-2023-39325","ts":1789384228760,"field":"severity","old":"none","new":"high"},{"seq":195853,"id":"CVE-2023-39325","ts":1789383140389,"field":"cvss","old":"7.5","new":null},{"seq":195852,"id":"CVE-2023-39325","ts":1789383140389,"field":"severity","old":"high","new":"none"},{"seq":194781,"id":"CVE-2023-39325","ts":1789380201578,"field":"cvss","old":null,"new":"7.5"},{"seq":194780,"id":"CVE-2023-39325","ts":1789380201578,"field":"severity","old":"none","new":"high"},{"seq":193569,"id":"CVE-2023-39325","ts":1789377990031,"field":"cvss","old":"7.5","new":null},{"seq":193568,"id":"CVE-2023-39325","ts":1789377990031,"field":"severity","old":"high","new":"none"},{"seq":192355,"id":"CVE-2023-39325","ts":1789376117910,"field":"cvss","old":null,"new":"7.5"},{"seq":192354,"id":"CVE-2023-39325","ts":1789376117910,"field":"severity","old":"none","new":"high"},{"seq":191143,"id":"CVE-2023-39325","ts":1789372838927,"field":"cvss","old":"7.5","new":null},{"seq":191142,"id":"CVE-2023-39325","ts":1789372838927,"field":"severity","old":"high","new":"none"},{"seq":189927,"id":"CVE-2023-39325","ts":1789369042389,"field":"cvss","old":null,"new":"7.5"},{"seq":189926,"id":"CVE-2023-39325","ts":1789369042389,"field":"severity","old":"none","new":"high"},{"seq":188715,"id":"CVE-2023-39325","ts":1789367830865,"field":"cvss","old":"7.5","new":null},{"seq":188714,"id":"CVE-2023-39325","ts":1789367830865,"field":"severity","old":"high","new":"none"},{"seq":187497,"id":"CVE-2023-39325","ts":1789364889513,"field":"cvss","old":null,"new":"7.5"},{"seq":187496,"id":"CVE-2023-39325","ts":1789364889513,"field":"severity","old":"none","new":"high"},{"seq":186285,"id":"CVE-2023-39325","ts":1789362762211,"field":"cvss","old":"7.5","new":null},{"seq":186284,"id":"CVE-2023-39325","ts":1789362762211,"field":"severity","old":"high","new":"none"},{"seq":185070,"id":"CVE-2023-39325","ts":1789360875768,"field":"cvss","old":null,"new":"7.5"},{"seq":185069,"id":"CVE-2023-39325","ts":1789360875768,"field":"severity","old":"none","new":"high"},{"seq":183858,"id":"CVE-2023-39325","ts":1789357667349,"field":"cvss","old":"7.5","new":null},{"seq":183857,"id":"CVE-2023-39325","ts":1789357667349,"field":"severity","old":"high","new":"none"},{"seq":182110,"id":"CVE-2023-39325","ts":1789354013134,"field":"cvss","old":null,"new":"7.5"},{"seq":182109,"id":"CVE-2023-39325","ts":1789354013134,"field":"severity","old":"none","new":"high"},{"seq":180903,"id":"CVE-2023-39325","ts":1789352726869,"field":"cvss","old":"7.5","new":null},{"seq":180902,"id":"CVE-2023-39325","ts":1789352726869,"field":"severity","old":"high","new":"none"},{"seq":179696,"id":"CVE-2023-39325","ts":1789349884191,"field":"cvss","old":null,"new":"7.5"},{"seq":179695,"id":"CVE-2023-39325","ts":1789349884191,"field":"severity","old":"none","new":"high"},{"seq":178489,"id":"CVE-2023-39325","ts":1789347533819,"field":"cvss","old":"7.5","new":null},{"seq":178488,"id":"CVE-2023-39325","ts":1789347533819,"field":"severity","old":"high","new":"none"},{"seq":177282,"id":"CVE-2023-39325","ts":1789346069173,"field":"cvss","old":null,"new":"7.5"},{"seq":177281,"id":"CVE-2023-39325","ts":1789346069173,"field":"severity","old":"none","new":"high"},{"seq":176075,"id":"CVE-2023-39325","ts":1789342523200,"field":"cvss","old":"7.5","new":null},{"seq":176074,"id":"CVE-2023-39325","ts":1789342523200,"field":"severity","old":"high","new":"none"},{"seq":175861,"id":"CVE-2023-39325","ts":1789342134946,"field":"cvss","old":null,"new":"7.5"},{"seq":175860,"id":"CVE-2023-39325","ts":1789342134946,"field":"severity","old":"none","new":"high"},{"seq":175399,"id":"CVE-2023-39325","ts":1789338119062,"field":"cvss","old":"7.5","new":null},{"seq":175398,"id":"CVE-2023-39325","ts":1789338119062,"field":"severity","old":"high","new":"none"},{"seq":174194,"id":"CVE-2023-39325","ts":1789334498441,"field":"cvss","old":null,"new":"7.5"},{"seq":174193,"id":"CVE-2023-39325","ts":1789334498441,"field":"severity","old":"none","new":"high"},{"seq":173008,"id":"CVE-2023-39325","ts":1789333087448,"field":"cvss","old":"7.5","new":null},{"seq":173007,"id":"CVE-2023-39325","ts":1789333087448,"field":"severity","old":"high","new":"none"},{"seq":171822,"id":"CVE-2023-39325","ts":1789330821075,"field":"cvss","old":null,"new":"7.5"},{"seq":171821,"id":"CVE-2023-39325","ts":1789330821075,"field":"severity","old":"none","new":"high"}]}