[GO-2024-2963] Denial of service due to improper 100-continue handling in net/http

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 1

The net/http HTTP/1.1 client mishandled the case where a server responds to a
request with an "Expect: 100-continue" header with a non-informational (200 or
higher) status. This mishandling could leave a client connection in an invalid
state, where the next request sent on the connection will fail.

An attacker sending a request to a net/http/httputil.ReverseProxy proxy can
exploit this mishandling to cause a denial of service by sending "Expect:
100-continue" requests which elicit a non-informational response from the
backend. Each such request leaves the proxy with an invalid connection, and
causes one subsequent request using that connection to fail.

Package Affected Version
pkg:golang/net/http >= 1.22.4, < 1.21.12
pkg:golang/net/http >= 1.22.4, < 1.22.5
Package Fixed Version
pkg:golang/net/http = 1.21.12
pkg:golang/net/http = 1.22.5
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:golang/net/http net http = 1.21.12
Affected pkg:golang/net/http net http >= 1.22.4 < 1.21.12
Fixed pkg:golang/net/http net http = 1.22.5
Affected pkg:golang/net/http net http >= 1.22.4 < 1.22.5
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...