An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade podman-remoteUpgrade podman-gvproxyUpgrade podman-dockerUpgrade criu-libsUpgrade netavarkUpgrade buildahUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade toolbox-testsUpgrade python3-podmanUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade osbuild-composer-coreUpgrade containernetworking-pluginsUpgrade osbuild-composerUpgrade criuUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade libslirp-develUpgrade critUpgrade runcUpgrade crunUpgrade toolboxUpgrade skopeo-testsUpgrade udicaUpgrade osbuild-composer-dnf-jsonUpgrade weldr-clientUpgrade osbuild-composer-workerUpgrade conmonUpgrade git-lfsUpgrade libslirpUpgrade grafanaUpgrade skopeoUpgrade podman-testsUpgrade container-selinuxUpgrade criu-develUpgrade python3-criuUpgrade podman-plugins | May 15, 2023 | Dec 8, 2022 |
| Alpine Linux | — | Upgrade minio-clientUpgrade go | Aug 22, 2024 | Dec 8, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golangUpgrade golang-binUpgrade golang-miscUpgrade golang-testsUpgrade golang-sharedUpgrade golang-docsUpgrade golang-race | Feb 7, 2023 | Dec 8, 2022 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Oct 20, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-sharedUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade golang-src | Feb 17, 2025 | Nov 30, 2022 |
| Centos_linux | — | Upgrade foreman_ygg_workerUpgrade puppet-agentUpgrade yggdrasil | May 5, 2023 | Dec 8, 2022 |
| Debian | — | Upgrade golang-golang-x-netUpgrade golang-1.19 | Jul 30, 2024 | Dec 8, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Dec 7, 2022 | Dec 6, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go.Upgrade app-containers/docker.Upgrade app-admin/consul. | Nov 27, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 20, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 24, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Jan 10, 2024 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Mar 9, 2023 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade podman-testsUpgrade libslirp-develUpgrade conmonUpgrade aardvark-dnsUpgrade containers-commonUpgrade slirp4netnsUpgrade go-toolsetUpgrade osbuild-ostreeUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade osbuild-composer-dnf-jsonUpgrade git-lfsUpgrade golang-raceUpgrade libslirpUpgrade python3-osbuildUpgrade python3-podmanUpgrade buildahUpgrade podman-gvproxyUpgrade golang-miscUpgrade osbuild-selinuxUpgrade criu-libsUpgrade osbuild-lvm2Upgrade grafanaUpgrade osbuild-composer-coreUpgrade fuse-overlayfsUpgrade golang-srcUpgrade osbuild-luks2Upgrade golangUpgrade containernetworking-pluginsUpgrade runcUpgrade cockpit-composerUpgrade critUpgrade golang-docsUpgrade weldr-clientUpgrade skopeoUpgrade osbuild-composerUpgrade podmanUpgrade udicaUpgrade podman-dockerUpgrade skopeo-testsUpgrade golang-testsUpgrade golang-binUpgrade crunUpgrade buildah-testsUpgrade python3-criuUpgrade podman-pluginsUpgrade osbuildUpgrade delveUpgrade container-selinuxUpgrade podman-catatonitUpgrade criuUpgrade podman-remoteUpgrade criu-develUpgrade osbuild-composer-worker | Mar 8, 2023 | Nov 30, 2022 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade podmanUpgrade cri-oUpgrade skopeoUpgrade openshiftUpgrade windows-machine-config-rhel9-operatorUpgrade microshift | Mar 31, 2023 | Nov 30, 2022 |
| Redhat_linux | — | Upgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade udicaUpgrade conmon-debuginfoUpgrade osbuild-composer-coreUpgrade runcUpgrade toolbox-debugsourceUpgrade golang-miscUpgrade weldr-client-tests-debuginfoUpgrade osbuild-luks2Upgrade python3-podmanUpgrade golang-srcUpgrade netavarkUpgrade osbuild-composer-worker-debuginfoUpgrade criu-debugsourceUpgrade osbuildUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade skopeo-debuginfoUpgrade toolbox-testsUpgrade skopeo-debugsourceUpgrade golang-raceUpgrade delve-debugsourceUpgrade osbuild-composer-debugsourceUpgrade cockpit-podmanUpgrade golang-binUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade critUpgrade golang-testsUpgrade podman-remoteUpgrade osbuild-composerUpgrade criuUpgrade toolboxUpgrade podman-testsUpgrade git-lfs-debuginfoUpgrade conmonUpgrade slirp4netnsUpgrade python3-osbuildUpgrade runc-debugsourceUpgrade criu-debuginfoNo solution existsUpgrade buildah-debuginfoUpgrade podman-dockerUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade golangUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade podman-debuginfoUpgrade buildah-testsUpgrade podmanUpgrade containernetworking-pluginsUpgrade grafana-debuginfoUpgrade runc-debuginfoUpgrade osbuild-selinuxUpgrade osbuild-ostreeUpgrade buildah-debugsourceUpgrade python3-criuUpgrade skopeo-testsUpgrade delve-debuginfoUpgrade libslirp-develUpgrade toolbox-debuginfoUpgrade crunUpgrade git-lfsUpgrade osbuild-lvm2Upgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade git-lfs-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade delveUpgrade podman-catatonit-debuginfoUpgrade weldr-client-debugsourceUpgrade weldr-client-debuginfoUpgrade crun-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade containernetworking-plugins-debugsourceUpgrade golang-docsUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade crun-debuginfoUpgrade go-toolsetUpgrade osbuild-composer-workerUpgrade libslirp-debuginfoUpgrade weldr-clientUpgrade slirp4netns-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade grafana-debugsourceUpgrade cockpit-composerUpgrade criu-libsUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade container-selinuxUpgrade grafanaUpgrade libslirp-debugsourceUpgrade libslirpUpgrade podman-remote-debuginfo | May 5, 2023 | Dec 8, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade criu-libsUpgrade libdb-utils-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libdb-sql-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-debuginfoUpgrade libdb-debuginfoUpgrade libslirp-develUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade critUpgrade libdb-cxx-debuginfoUpgrade libslirp-debuginfoUpgrade libslirpUpgrade criuUpgrade libdb-debugsourceUpgrade criu-devel | Mar 5, 2024 | Dec 8, 2022 |
| Suse | — | Upgrade go1.18-raceUpgrade go1.19-raceUpgrade go1.18Upgrade go1.18-openssl-docUpgrade go1.19Upgrade go1.19-docUpgrade go1.18-docUpgrade go1.18-openssl-raceUpgrade go1.18-openssl | Dec 12, 2022 | Dec 8, 2022 |
| Ubuntu | — | Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.16-srcUpgrade golang-1.18-srcUpgrade golang-1.18Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13 | May 1, 2023 | Dec 8, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub