GO-2023-1495

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2023-1495

Import Source

https://vuln.go.dev/ID/GO-2023-1495.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2023-1495

Aliases

Published

2023-01-13T22:39:40Z

Modified

2024-05-20T16:03:47Z

Summary

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

Details

A request smuggling attack is possible when using MaxBytesHandler.

When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2023-1495"
}

References

Credits

- John Howard (Google)

Affected packages

Go / golang.org/x/net

Package

Name: golang.org/x/net; View open source insights on deps.dev
Purl: pkg:golang/golang.org/x/net

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-20220524220425-1d687d428aca

Fixed

0.1.1-0.20221104162952-702349b0e862

Ecosystem specific

{
    "imports": [
        {
            "path": "golang.org/x/net/http2/h2c",
            "symbols": [
                "h2cHandler.ServeHTTP",
                "h2cUpgrade"
            ]
        }
    ]
}