GHSA-39qc-96h7-956f

Source

https://github.com/advisories/GHSA-39qc-96h7-956f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-39qc-96h7-956f/GHSA-39qc-96h7-956f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-39qc-96h7-956f

Aliases

Related

Published

2022-05-24T16:53:19Z

Modified

2024-05-20T21:30:41Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

golang.org/x/net/http vulnerable to a reset flood

Details

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RSTSTREAM frames from the peer. Depending on how the peer queues the RSTSTREAM frames, this can consume excess memory, CPU, or both.

Specific Go Packages Affected

golang.org/x/net/http2

Database specific

{
    "nvd_published_at": "2019-08-13T21:15:00Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T00:30:39Z"
}

References

Affected packages

Go / golang.org/x/net

Package

Name: golang.org/x/net; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/net

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20190813141303-74dc4d7220e7