HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade aardvark-dnsUpgrade podman-gvproxyUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade runcUpgrade cockpit-podmanUpgrade buildah-testsUpgrade udicaUpgrade podman-dockerUpgrade skopeoUpgrade podmanUpgrade podman-catatonitUpgrade buildahUpgrade slirp4netnsUpgrade netavarkUpgrade toolboxUpgrade toolbox-testsUpgrade conmonUpgrade podman-testsUpgrade criuUpgrade python3-podmanUpgrade podman-remoteUpgrade critUpgrade criu-develUpgrade libslirpUpgrade libslirp-develUpgrade containers-commonUpgrade crunUpgrade grafanaUpgrade container-selinuxUpgrade skopeo-testsUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade criu-libs | Nov 16, 2023 | Apr 6, 2023 |
| Alpine Linux | — | Upgrade traefikUpgrade goUpgrade nomad | Aug 22, 2024 | Apr 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade containerdUpgrade containerd-stressUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade golang-docsUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade golang-raceUpgrade golangUpgrade golang-misc | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade golang-binUpgrade golang-docsUpgrade golang-sharedUpgrade golang-srcUpgrade golang-testsUpgrade golang-raceUpgrade golang | Feb 17, 2025 | Apr 4, 2023 |
| Centos_linux | — | Upgrade slirp4netnsUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade grafana-debuginfoUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade toolbox-debuginfoUpgrade golangUpgrade toolboxUpgrade conmon-debugsourceUpgrade golang-binUpgrade golang-docsUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade libslirp-debuginfoUpgrade crunUpgrade udicaUpgrade podman-gvproxy-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade delve-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade golang-testsUpgrade cockpit-podmanUpgrade buildah-testsUpgrade skopeoUpgrade buildahUpgrade podman-remoteUpgrade netavarkUpgrade podman-testsUpgrade skopeo-debugsourceUpgrade criu-debuginfoUpgrade runcUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade toolbox-debugsourceUpgrade criuUpgrade podman-debuginfoUpgrade podman-dockerUpgrade critUpgrade oci-seccomp-bpf-hookUpgrade crun-debuginfoUpgrade criu-libsUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade container-selinuxUpgrade slirp4netns-debuginfoUpgrade libslirp-debugsourceUpgrade criu-develUpgrade podman-plugins-debuginfoUpgrade python3-podmanUpgrade delve-debuginfoUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade libslirpUpgrade golang-srcUpgrade go-toolsetUpgrade golang-raceUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafanaUpgrade golang-miscUpgrade delveUpgrade conmon-debuginfoUpgrade runc-debuginfoUpgrade libslirp-develUpgrade grafana-debugsourceUpgrade skopeo-testsUpgrade buildah-debugsourceUpgrade python3-criuUpgrade crun-debugsource | Oct 23, 2023 | Apr 6, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Apr 6, 2023 |
| Freebsd | — | Upgrade go119Upgrade traefikUpgrade go120 | Apr 14, 2023 | Apr 7, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jul 18, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 10, 2024 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jul 10, 2023 | Apr 6, 2023 |
| Oracle_linux | — | Upgrade skopeoUpgrade podman-pluginsUpgrade critUpgrade libslirp-develUpgrade containers-commonUpgrade criu-develUpgrade podman-remoteUpgrade podmanUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade criuUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade runcUpgrade podman-catatonitUpgrade crunUpgrade buildahUpgrade udicaUpgrade grafanaUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade container-selinuxUpgrade libslirpUpgrade slirp4netnsUpgrade python3-podmanUpgrade conmonUpgrade cockpit-podmanUpgrade podman-testsUpgrade podman-dockerUpgrade python3-criuUpgrade buildah-tests | Nov 16, 2023 | Apr 4, 2023 |
| Redhat Openshift | — | Upgrade conmonUpgrade openshift-clientsUpgrade microshiftUpgrade cri-oUpgrade cri-toolsUpgrade openshiftUpgrade kernelUpgrade skopeoUpgrade buildahUpgrade podmanUpgrade openstack-ironicUpgrade kernel-rt | Jun 15, 2023 | Apr 4, 2023 |
| Redhat_linux | — | Upgrade toolboxUpgrade toolbox-debugsourceUpgrade podman-debugsourceUpgrade crun-debugsourceUpgrade container-selinuxUpgrade containers-commonUpgrade criu-libsUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade libslirp-develUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debugsourceUpgrade skopeoUpgrade slirp4netns-debugsourceUpgrade golang-docsUpgrade grafana-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-plugins-debuginfoUpgrade runcUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade go-toolsetUpgrade golang-binUpgrade libslirpUpgrade delveUpgrade grafanaUpgrade criu-develUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade conmonUpgrade crun-debuginfoUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-pluginsUpgrade udicaUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-criuUpgrade critUpgrade crunUpgrade delve-debugsourceUpgrade containernetworking-pluginsUpgrade skopeo-debuginfoUpgrade criu-debugsourceNo solution existsUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade golang-miscUpgrade golang-raceUpgrade skopeo-debugsourceUpgrade buildahUpgrade criu-debuginfoUpgrade podman-dockerUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade golang-testsUpgrade podmanUpgrade conmon-debuginfoUpgrade delve-debuginfoUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade buildah-testsUpgrade golangUpgrade golang-srcUpgrade slirp4netnsUpgrade criuUpgrade cockpit-podmanUpgrade python3-podmanUpgrade podman-gvproxyUpgrade netavarkUpgrade toolbox-tests | Oct 23, 2023 | Apr 6, 2023 |
| Rocky_linux | — | Upgrade podman-debugsourceUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netnsUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade crun-debuginfoUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade runcUpgrade runc-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade criu-libsUpgrade runc-debuginfoUpgrade critUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criuUpgrade buildah-debugsourceUpgrade criu-debuginfoUpgrade conmonUpgrade crun-debugsourceUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade crunUpgrade fuse-overlayfsUpgrade podmanUpgrade podman-testsUpgrade podman-catatonitUpgrade libslirpUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-remote-debuginfoUpgrade netavarkUpgrade conmon-debugsourceUpgrade buildah | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade go1.20-raceUpgrade go1.19-raceUpgrade go1.19Upgrade go1.20-docUpgrade go1.20Upgrade go1.19-doc | Apr 10, 2023 | Apr 6, 2023 |
| Ubuntu | — | Upgrade golang-1.13-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.19-goUpgrade golang-1.20-goUpgrade golang-1.16-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.19-srcUpgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.19Upgrade golang-1.13-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13Upgrade golang-1.20Upgrade golang-1.20-srcUpgrade golang-1.18-srcUpgrade golang-1.16-go | May 1, 2023 | Apr 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub