GHSA-xrjj-mj9h-534m

Suggest an improvement
Source
https://github.com/advisories/GHSA-xrjj-mj9h-534m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-xrjj-mj9h-534m/GHSA-xrjj-mj9h-534m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xrjj-mj9h-534m
Aliases
Related
Published
2022-12-08T21:30:19Z
Modified
2024-05-20T21:41:40Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
golang.org/x/net/http2 vulnerable to possible excessive memory growth
Details

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Database specific 
{
    "nvd_published_at": "2022-12-08T20:15:00Z",
    "cwe_ids": [
        "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-18T00:05:16Z"
}
References

Affected packages

Go / golang.org/x/net/http2

Package

Name
golang.org/x/net/http2
View open source insights on deps.dev
Purl
pkg:golang/golang.org/x/net/http2

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.0

Ecosystem specific 

{
    "affected_functions": [
        "Server.ServeConn"
    ]
}

Go / golang.org/x/net

Package

Name
golang.org/x/net
View open source insights on deps.dev
Purl
pkg:golang/golang.org/x/net

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.0