An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composerUpgrade criu-libsUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade containers-commonUpgrade osbuild-composer-coreUpgrade criuUpgrade podmanUpgrade containernetworking-pluginsUpgrade python3-podmanUpgrade podman-remoteUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade netavarkUpgrade podman-catatonitUpgrade toolbox-testsUpgrade podman-dockerUpgrade libslirpUpgrade grafanaUpgrade git-lfsUpgrade runcUpgrade udicaUpgrade python3-criuUpgrade podman-testsUpgrade libslirp-develUpgrade crunUpgrade weldr-clientUpgrade container-selinuxUpgrade osbuild-composer-workerUpgrade critUpgrade criu-develUpgrade podman-pluginsUpgrade osbuild-composer-dnf-jsonUpgrade skopeoUpgrade conmonUpgrade toolboxUpgrade skopeo-tests | May 15, 2023 | Dec 8, 2022 |
| Alpine Linux | — | Upgrade goUpgrade minio-client | Aug 22, 2024 | Dec 8, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-srcUpgrade golang-binUpgrade golangUpgrade golang-sharedUpgrade golang-testsUpgrade golang-raceUpgrade golang-docs | Feb 7, 2023 | Dec 8, 2022 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Oct 20, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-srcUpgrade golangUpgrade golang-raceUpgrade golang-sharedUpgrade golang-misc | Feb 17, 2025 | Nov 30, 2022 |
| Centos_linux | — | Upgrade puppet-agentUpgrade yggdrasilUpgrade foreman_ygg_worker | May 5, 2023 | Dec 8, 2022 |
| Debian | — | Upgrade golang-1.19Upgrade golang-golang-x-net | Jul 30, 2024 | Dec 8, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Dec 7, 2022 | Dec 6, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go.Upgrade app-containers/docker.Upgrade app-admin/consul. | Nov 27, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 20, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 24, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Jan 10, 2024 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 9, 2023 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade osbuild-composer-workerUpgrade podman-pluginsUpgrade golang-binUpgrade crunUpgrade weldr-clientUpgrade golang-testsUpgrade cockpit-composerUpgrade runcUpgrade skopeoUpgrade osbuildUpgrade criu-develUpgrade criuUpgrade critUpgrade python3-criuUpgrade udicaUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade podmanUpgrade podman-dockerUpgrade delveUpgrade skopeo-testsUpgrade golang-docsUpgrade podman-catatonitUpgrade buildah-testsUpgrade osbuild-composerUpgrade go-toolsetUpgrade golang-raceUpgrade osbuild-selinuxUpgrade osbuild-luks2Upgrade criu-libsUpgrade cockpit-podmanUpgrade libslirpUpgrade containers-commonUpgrade netavarkUpgrade osbuild-composer-dnf-jsonUpgrade oci-seccomp-bpf-hookUpgrade git-lfsUpgrade python3-podmanUpgrade conmonUpgrade osbuild-composer-coreUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade buildahUpgrade golang-miscUpgrade osbuild-lvm2Upgrade python3-osbuildUpgrade grafanaUpgrade golangUpgrade libslirp-develUpgrade podman-testsUpgrade osbuild-ostreeUpgrade podman-gvproxyUpgrade golang-src | Mar 8, 2023 | Nov 30, 2022 |
| Redhat Openshift | — | Upgrade skopeoUpgrade openshiftUpgrade podmanUpgrade openshift-clientsUpgrade cri-oUpgrade windows-machine-config-rhel9-operatorUpgrade microshift | Mar 31, 2023 | Nov 30, 2022 |
| Redhat_linux | — | Upgrade python3-criuUpgrade buildah-debugsourceUpgrade delve-debuginfoUpgrade osbuild-ostreeUpgrade runc-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-docsUpgrade git-lfsUpgrade osbuild-composer-debuginfoUpgrade containers-commonUpgrade crunUpgrade osbuild-selinuxUpgrade weldr-clientUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade crun-debugsourceUpgrade slirp4netns-debuginfoUpgrade criu-libsUpgrade skopeo-testsUpgrade crun-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade osbuild-lvm2Upgrade go-toolsetUpgrade libslirp-debuginfoUpgrade osbuild-composer-workerUpgrade weldr-client-debuginfoUpgrade grafana-debugsourceUpgrade cockpit-composerUpgrade osbuild-composer-tests-debuginfoUpgrade git-lfs-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-catatonit-debuginfoUpgrade container-selinuxUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade libslirp-debugsourceUpgrade grafanaUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-core-debuginfoUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade weldr-client-debugsourceUpgrade netavarkUpgrade golang-binUpgrade golangUpgrade podman-gvproxyUpgrade osbuild-composer-debugsourceUpgrade buildah-debuginfoUpgrade podmanUpgrade skopeoUpgrade golang-raceUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade criu-debuginfoUpgrade toolboxUpgrade python3-osbuildNo solution existsUpgrade golang-testsUpgrade skopeo-debugsourceUpgrade criu-debugsourceUpgrade skopeo-debuginfoUpgrade delve-debugsourceUpgrade toolbox-testsUpgrade podman-dockerUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade podman-debuginfoUpgrade git-lfs-debuginfoUpgrade golang-miscUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade weldr-client-tests-debuginfoUpgrade osbuild-composer-coreUpgrade buildah-testsUpgrade osbuild-luks2Upgrade toolbox-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade runcUpgrade udicaUpgrade critUpgrade osbuild-composerUpgrade grafana-debuginfoUpgrade buildahUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade podman-testsUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade conmon-debuginfoUpgrade conmonUpgrade golang-srcUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade criuUpgrade osbuild | May 5, 2023 | Dec 8, 2022 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsourceUpgrade libdb-debugsourceUpgrade libslirp-debuginfoUpgrade critUpgrade libdb-cxx-debuginfoUpgrade libslirpUpgrade criu-develUpgrade criuUpgrade libdb-sql-devel-debuginfoUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade libdb-sql-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libdb-cxxUpgrade criu-debugsourceUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade criu-libsUpgrade libslirp-develUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hook | Mar 5, 2024 | Dec 8, 2022 |
| Suse | — | Upgrade go1.18Upgrade go1.18-openssl-docUpgrade go1.18-raceUpgrade go1.19-raceUpgrade go1.19-docUpgrade go1.18-docUpgrade go1.18-openssl-raceUpgrade go1.18-opensslUpgrade go1.19 | Dec 12, 2022 | Dec 8, 2022 |
| Ubuntu | — | Upgrade golang-1.13-srcUpgrade golang-1.13-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.16Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-goUpgrade golang-1.16-srcUpgrade golang-1.18-goUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18 | May 1, 2023 | Dec 8, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub