An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade buildah-testsUpgrade criu-libsUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade buildahUpgrade podmanUpgrade cockpit-podmanUpgrade podman-dockerUpgrade osbuild-composerUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-coreUpgrade criuUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-catatonitUpgrade slirp4netnsUpgrade python3-podmanUpgrade podman-remoteUpgrade podman-gvproxyUpgrade netavarkUpgrade libslirpUpgrade weldr-clientUpgrade conmonUpgrade toolboxUpgrade criu-develUpgrade udicaUpgrade osbuild-composer-workerUpgrade runcUpgrade container-selinuxUpgrade skopeo-testsUpgrade grafanaUpgrade python3-criuUpgrade podman-testsUpgrade git-lfsUpgrade skopeoUpgrade podman-pluginsUpgrade crunUpgrade libslirp-develUpgrade osbuild-composer-dnf-jsonUpgrade crit | May 15, 2023 | Dec 8, 2022 |
| Alpine Linux | — | Upgrade goUpgrade minio-client | Aug 22, 2024 | Dec 8, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang-miscUpgrade golangUpgrade golang-raceUpgrade golang-sharedUpgrade golang-docsUpgrade golang-tests | Feb 7, 2023 | Dec 8, 2022 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Oct 20, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-docsUpgrade golang-binUpgrade golang-srcUpgrade golang-miscUpgrade golang-sharedUpgrade golang-raceUpgrade golang | Feb 17, 2025 | Nov 30, 2022 |
| Centos_linux | — | Upgrade puppet-agentUpgrade yggdrasilUpgrade foreman_ygg_worker | May 5, 2023 | Dec 8, 2022 |
| Debian | — | Upgrade golang-golang-x-netUpgrade golang-1.19 | Jul 30, 2024 | Dec 8, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Dec 7, 2022 | Dec 6, 2022 |
| Gentoo Linux | — | Upgrade app-containers/docker.Upgrade app-admin/consul.Upgrade dev-lang/go. | Nov 27, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 20, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 24, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Jan 10, 2024 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Mar 9, 2023 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade libslirp-develUpgrade buildahUpgrade golang-miscUpgrade osbuild-lvm2Upgrade osbuild-composer-dnf-jsonUpgrade containers-commonUpgrade golang-srcUpgrade libslirpUpgrade osbuild-ostreeUpgrade osbuild-selinuxUpgrade fuse-overlayfsUpgrade netavarkUpgrade podman-testsUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade python3-podmanUpgrade golangUpgrade golang-raceUpgrade osbuild-luks2Upgrade podman-gvproxyUpgrade grafanaUpgrade osbuild-composer-coreUpgrade go-toolsetUpgrade criu-libsUpgrade python3-osbuildUpgrade git-lfsUpgrade slirp4netnsUpgrade podmanUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade skopeo-testsUpgrade weldr-clientUpgrade skopeoUpgrade runcUpgrade cockpit-composerUpgrade udicaUpgrade delveUpgrade podman-dockerUpgrade osbuild-composerUpgrade podman-pluginsUpgrade osbuild-composer-workerUpgrade osbuildUpgrade golang-testsUpgrade golang-binUpgrade crunUpgrade podman-catatonitUpgrade criu-develUpgrade python3-criuUpgrade podman-remoteUpgrade criuUpgrade critUpgrade golang-docsUpgrade buildah-tests | Mar 8, 2023 | Nov 30, 2022 |
| Redhat Openshift | — | Upgrade microshiftUpgrade windows-machine-config-rhel9-operatorUpgrade openshift-clientsUpgrade podmanUpgrade openshiftUpgrade skopeoUpgrade cri-o | Mar 31, 2023 | Nov 30, 2022 |
| Redhat_linux | — | Upgrade criu-libs-debuginfoUpgrade osbuildUpgrade critUpgrade golang-raceUpgrade osbuild-composer-worker-debuginfoUpgrade buildahUpgrade podman-remoteUpgrade skopeoUpgrade toolboxUpgrade podman-gvproxyUpgrade python3-podmanUpgrade podman-testsUpgrade fuse-overlayfsUpgrade osbuild-composerUpgrade git-lfs-debuginfoUpgrade delve-debugsourceUpgrade golang-binNo solution existsUpgrade golang-testsUpgrade runc-debugsourceUpgrade buildah-debuginfoUpgrade netavarkUpgrade grafana-debuginfoUpgrade podman-debuginfoUpgrade golang-srcUpgrade skopeo-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade skopeo-debugsourceUpgrade toolbox-debugsourceUpgrade udicaUpgrade osbuild-composer-debugsourceUpgrade osbuild-luks2Upgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade runcUpgrade weldr-client-tests-debuginfoUpgrade osbuild-composer-coreUpgrade conmon-debuginfoUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade podmanUpgrade podman-dockerUpgrade criu-debugsourceUpgrade slirp4netnsUpgrade golangUpgrade conmonUpgrade golang-miscUpgrade python3-osbuildUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade cockpit-podmanUpgrade criuUpgrade libslirp-develUpgrade container-selinuxUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade golang-docsUpgrade osbuild-ostreeUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composer-debuginfoUpgrade weldr-clientUpgrade osbuild-lvm2Upgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade grafanaUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-selinuxUpgrade podman-debugsourceUpgrade delve-debuginfoUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade cockpit-composerUpgrade skopeo-testsUpgrade grafana-debugsourceUpgrade podman-pluginsUpgrade crunUpgrade python3-criuUpgrade git-lfsUpgrade containers-commonUpgrade git-lfs-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-composer-workerUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade delveUpgrade weldr-client-debuginfoUpgrade weldr-client-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-catatonit-debuginfoUpgrade toolbox-debuginfoUpgrade podman-remote-debuginfoUpgrade go-toolsetUpgrade criu-libsUpgrade containernetworking-plugins-debugsource | May 5, 2023 | Dec 8, 2022 |
| Rocky_linux | — | Upgrade libslirp-develUpgrade criu-debuginfoUpgrade libdb-utils-debuginfoUpgrade criu-libsUpgrade libdb-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libdb-sql-debuginfoUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libdb-cxxUpgrade libslirpUpgrade python3-criuUpgrade critUpgrade libdb-cxx-debuginfoUpgrade libslirp-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade libslirp-debugsourceUpgrade criu-develUpgrade criu | Mar 5, 2024 | Dec 8, 2022 |
| Suse | — | Upgrade go1.19Upgrade go1.18-opensslUpgrade go1.19-docUpgrade go1.18-openssl-raceUpgrade go1.18-docUpgrade go1.19-raceUpgrade go1.18-raceUpgrade go1.18Upgrade go1.18-openssl-doc | Dec 12, 2022 | Dec 8, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.18-srcUpgrade golang-1.16Upgrade golang-1.13Upgrade golang-1.13-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-src | May 1, 2023 | Dec 8, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub