Skip to content
fr Sign in
7.5 High

CVE-2023-45288 An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of…

Description

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Affected products and versions

Product Affected versions Fixed in
net/http 1.22 1.22.0-0 → < 1.22.2 1.22.2
net/http 1.21 earliest → < 1.21.9 1.21.9
golang.org/x/net/http2 0.23 earliest → < 0.23.0 0.23.0
net\/http 1.22 1.22.0-0 → < 1.22.2 1.22.2
net\/http 1.21 earliest → < 1.21.9 1.21.9
http2 0.23 earliest → < 0.23.0 0.23.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/http

The 26 CVEs of net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 High CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 High
Track this CVE