[GO-2023-1571] Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Severity High

Affected Packages 4

Fixed Packages 4

CVEs 1

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the
HPACK decoder, sufficient to cause a denial of service from a small number of
small requests.

Package	Affected Version
pkg:golang/net/http	>= 1.20.0, < 1.19.6
pkg:golang/net/http	>= 1.20.0, < 1.20.1
pkg:golang/golang.org/x/net/http2/hpack	>= 0.6.1-0.20230213185550-547e7edf3873, < 0.7.0
pkg:golang/golang.org/x/net/http2	>= 0.6.1-0.20230213185550-547e7edf3873, < 0.7.0

Package	Fixed Version
pkg:golang/net/http	= 1.19.6
pkg:golang/net/http	= 1.20.1
pkg:golang/golang.org/x/net/http2/hpack	= 0.7.0
pkg:golang/golang.org/x/net/http2	= 0.7.0

ID

GO-2023-1571

Severity

high

Severity from

CVE-2022-41723

URL

https://pkg.go.dev/vuln/GO-2023-1571

Published

2023-02-16T21:43:34
(19 months ago)

Modified

2024-07-17T19:54:18
(2 months ago)

Other Advisories

Source	# ID	Name	URL
Security Advisory			https://github.com/advisories/GHSA-vvpx-j8f3-3w6h

Type	Package URL	Namespace	Name / Product	Version
Fixed	pkg:golang/net/http	net	http	= 1.19.6
Affected	pkg:golang/net/http	net	http	>= 1.20.0 < 1.19.6
Fixed	pkg:golang/net/http	net	http	= 1.20.1
Affected	pkg:golang/net/http	net	http	>= 1.20.0 < 1.20.1
Fixed	pkg:golang/golang.org/x/net/http2/hpack	golang.org/x/net/http2	hpack	= 0.7.0
Affected	pkg:golang/golang.org/x/net/http2/hpack	golang.org/x/net/http2	hpack	>= 0.6.1-0.20230213185550-547e7edf3873 < 0.7.0
Fixed	pkg:golang/golang.org/x/net/http2	golang.org/x/net	http2	= 0.7.0
Affected	pkg:golang/golang.org/x/net/http2	golang.org/x/net	http2	>= 0.6.1-0.20230213185550-547e7edf3873 < 0.7.0

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date