CVE-2023-45288Medium· 5.3▾ TwilightPoC availablenet/http, x/net/http2: close connections when receiving too many headers
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 18.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
92%
1 GitHub repo (last check)
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
net/http < 1.21.9golang.org/x/net/http2 < 0.23.0net/http >= 1.22.0-0, < 1.22.2golang.org/x/net < 0.23.0Upgrade to a patched release:
net/http 1.21.9golang.org/x/net/http2 0.23.0net/http 1.22.2golang.org/x/net 0.23.0