golang.org/x/net/http2 vulnerable to possible excessive memory growth
Moderate severity
GitHub Reviewed
Published
Dec 8, 2022
to the GitHub Advisory Database
•
Updated May 20, 2024
Description
Published by the National Vulnerability Database
Dec 8, 2022
Published to the GitHub Advisory Database
Dec 8, 2022
Reviewed
Jan 18, 2023
Last updated
May 20, 2024
Credits
-
westonsteimel Analyst
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
References