An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cockpit-podmanUpgrade criu-libsUpgrade containers-commonUpgrade osbuild-composerUpgrade fuse-overlayfsUpgrade criuUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade osbuild-composer-coreUpgrade toolbox-testsUpgrade buildah-testsUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade podman-dockerUpgrade podman-gvproxyUpgrade python3-podmanUpgrade buildahUpgrade netavarkUpgrade runcUpgrade libslirp-develUpgrade critUpgrade git-lfsUpgrade grafanaUpgrade libslirpUpgrade conmonUpgrade criu-develUpgrade podman-testsUpgrade python3-criuUpgrade osbuild-composer-workerUpgrade skopeoUpgrade container-selinuxUpgrade osbuild-composer-dnf-jsonUpgrade udicaUpgrade crunUpgrade weldr-clientUpgrade podman-pluginsUpgrade toolboxUpgrade skopeo-tests | May 15, 2023 | Dec 8, 2022 |
| Alpine Linux | — | Upgrade goUpgrade minio-client | Aug 22, 2024 | Dec 8, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-srcUpgrade golang-binUpgrade golangUpgrade golang-sharedUpgrade golang-testsUpgrade golang-docsUpgrade golang-race | Feb 7, 2023 | Dec 8, 2022 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Oct 20, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-testsUpgrade golang-binUpgrade golang-sharedUpgrade golang-miscUpgrade golangUpgrade golang-raceUpgrade golang-src | Feb 17, 2025 | Nov 30, 2022 |
| Centos_linux | — | Upgrade puppet-agentUpgrade yggdrasilUpgrade foreman_ygg_worker | May 5, 2023 | Dec 8, 2022 |
| Debian | — | Upgrade golang-1.19Upgrade golang-golang-x-net | Jul 30, 2024 | Dec 8, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Dec 7, 2022 | Dec 6, 2022 |
| Gentoo Linux | — | Upgrade app-admin/consul.Upgrade app-containers/docker.Upgrade dev-lang/go. | Nov 27, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Mar 20, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 24, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-binUpgrade golang-src | Jan 10, 2024 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Mar 9, 2023 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade podman-testsUpgrade aardvark-dnsUpgrade libslirpUpgrade netavarkUpgrade containers-commonUpgrade osbuild-composer-dnf-jsonUpgrade go-toolsetUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade osbuild-ostreeUpgrade libslirp-develUpgrade golang-raceUpgrade slirp4netnsUpgrade golang-miscUpgrade fuse-overlayfsUpgrade buildahUpgrade python3-osbuildUpgrade python3-podmanUpgrade golangUpgrade grafanaUpgrade osbuild-lvm2Upgrade conmonUpgrade osbuild-selinuxUpgrade podman-gvproxyUpgrade criu-libsUpgrade git-lfsUpgrade golang-srcUpgrade osbuild-luks2Upgrade cockpit-composerUpgrade osbuild-composerUpgrade criu-develUpgrade delveUpgrade crunUpgrade golang-testsUpgrade podman-remoteUpgrade container-selinuxUpgrade python3-criuUpgrade golang-binUpgrade criuUpgrade podman-pluginsUpgrade osbuild-composer-workerUpgrade osbuildUpgrade udicaUpgrade skopeo-testsUpgrade podmanUpgrade podman-dockerUpgrade weldr-clientUpgrade skopeoUpgrade runcUpgrade buildah-testsUpgrade critUpgrade golang-docsUpgrade containernetworking-pluginsUpgrade podman-catatonit | Mar 8, 2023 | Nov 30, 2022 |
| Redhat Openshift | — | Upgrade podmanUpgrade cri-oUpgrade skopeoUpgrade openshift-clientsUpgrade openshiftUpgrade microshiftUpgrade windows-machine-config-rhel9-operator | Mar 31, 2023 | Nov 30, 2022 |
| Redhat_linux | — | Upgrade toolbox-debugsourceUpgrade udicaUpgrade buildahUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade git-lfs-debuginfoUpgrade containernetworking-pluginsUpgrade grafana-debuginfoUpgrade osbuild-composer-coreUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade osbuild-composerUpgrade buildah-testsUpgrade criuUpgrade osbuildUpgrade conmon-debuginfoUpgrade podman-debuginfoUpgrade conmon-debugsourceUpgrade netavarkUpgrade golang-binUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade podman-testsUpgrade podman-catatonitUpgrade podman-dockerUpgrade osbuild-composer-debugsourceUpgrade podman-gvproxyUpgrade python3-podmanUpgrade conmonUpgrade golang-srcUpgrade osbuild-luks2Upgrade criu-debugsourceUpgrade podmanUpgrade python3-osbuildUpgrade skopeo-debugsourceUpgrade golangUpgrade golang-raceUpgrade skopeoUpgrade critUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade criu-debuginfoUpgrade criu-libs-debuginfoUpgrade runcUpgrade golang-testsUpgrade podman-remoteUpgrade skopeo-debuginfoUpgrade delve-debugsourceUpgrade fuse-overlayfsNo solution existsUpgrade osbuild-composer-worker-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade golang-miscUpgrade grafana-debugsourceUpgrade delveUpgrade container-selinuxUpgrade osbuild-composer-dnf-jsonUpgrade runc-debuginfoUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade osbuild-lvm2Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafanaUpgrade libslirp-debugsourceUpgrade git-lfs-debugsourceUpgrade criu-develUpgrade podman-pluginsUpgrade osbuild-composer-tests-debuginfoUpgrade weldr-client-debugsourceUpgrade weldr-client-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-workerUpgrade cockpit-composerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirpUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade crun-debuginfoUpgrade osbuild-composer-debuginfoUpgrade containers-commonUpgrade osbuild-composer-core-debuginfoUpgrade podman-debugsourceUpgrade crunUpgrade slirp4netns-debuginfoUpgrade golang-docsUpgrade criu-libsUpgrade git-lfsUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade weldr-clientUpgrade oci-seccomp-bpf-hookUpgrade go-toolsetUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade buildah-debugsourceUpgrade osbuild-ostreeUpgrade skopeo-testsUpgrade osbuild-selinuxUpgrade libslirp-devel | May 5, 2023 | Dec 8, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libslirp-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libslirpUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade critUpgrade criuUpgrade libdb-cxx-debuginfoUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-debuginfoUpgrade libslirp-develUpgrade libdb-sql-debuginfoUpgrade criu-libsUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx | Mar 5, 2024 | Dec 8, 2022 |
| Suse | — | Upgrade go1.18Upgrade go1.19-raceUpgrade go1.18-openssl-docUpgrade go1.18-raceUpgrade go1.18-docUpgrade go1.18-opensslUpgrade go1.19Upgrade go1.18-openssl-raceUpgrade go1.19-doc | Dec 12, 2022 | Dec 8, 2022 |
| Ubuntu | — | Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-goUpgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-srcUpgrade golang-1.16-goUpgrade golang-1.16Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-src (Ubuntu Pro) | May 1, 2023 | Dec 8, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub