An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade weldr-clientUpgrade skopeo-testsUpgrade critUpgrade crunUpgrade conmonUpgrade osbuild-composer-workerUpgrade toolboxUpgrade container-selinuxUpgrade libslirp-develUpgrade libslirpUpgrade podman-pluginsUpgrade skopeoUpgrade podman-testsUpgrade criu-develUpgrade osbuild-composer-dnf-jsonUpgrade grafanaUpgrade udicaUpgrade git-lfsUpgrade runcUpgrade python3-criuUpgrade netavarkUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade podman-remoteUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade buildahUpgrade criu-libsUpgrade criuUpgrade podman-catatonitUpgrade containers-commonUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-coreUpgrade slirp4netnsUpgrade toolbox-testsUpgrade osbuild-composerUpgrade buildah-testsUpgrade python3-podmanUpgrade podman | May 15, 2023 | Dec 8, 2022 |
| Alpine Linux | — | Upgrade goUpgrade minio-client | Aug 22, 2024 | Dec 8, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golang-docsUpgrade golang-sharedUpgrade golang-race | Feb 7, 2023 | Dec 8, 2022 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Oct 20, 2022 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade golang-sharedUpgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golang-tests | Feb 17, 2025 | Nov 30, 2022 |
| Centos_linux | — | Upgrade puppet-agentUpgrade yggdrasilUpgrade foreman_ygg_worker | May 5, 2023 | Dec 8, 2022 |
| Debian | — | Upgrade golang-1.19Upgrade golang-golang-x-net | Jul 30, 2024 | Dec 8, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Dec 7, 2022 | Dec 6, 2022 |
| Gentoo Linux | — | Upgrade app-admin/consul.Upgrade dev-lang/go.Upgrade app-containers/docker. | Nov 27, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Mar 20, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 24, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Jan 10, 2024 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Mar 9, 2023 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade go-toolsetUpgrade git-lfsUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade osbuild-composer-coreUpgrade aardvark-dnsUpgrade python3-podmanUpgrade osbuild-ostreeUpgrade libslirp-develUpgrade osbuild-selinuxUpgrade golang-srcUpgrade buildahUpgrade golang-miscUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade netavarkUpgrade containers-commonUpgrade osbuild-composer-dnf-jsonUpgrade libslirpUpgrade python3-osbuildUpgrade golangUpgrade osbuild-lvm2Upgrade grafanaUpgrade podman-testsUpgrade conmonUpgrade golang-raceUpgrade osbuild-luks2Upgrade skopeo-testsUpgrade golang-binUpgrade criu-develUpgrade criuUpgrade python3-criuUpgrade podman-remoteUpgrade podmanUpgrade osbuild-composer-workerUpgrade podman-pluginsUpgrade osbuildUpgrade podman-dockerUpgrade udicaUpgrade delveUpgrade critUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade podman-catatonitUpgrade golang-docsUpgrade buildah-testsUpgrade osbuild-composerUpgrade golang-testsUpgrade crunUpgrade skopeoUpgrade runcUpgrade cockpit-composerUpgrade weldr-client | Mar 8, 2023 | Nov 30, 2022 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel9-operatorUpgrade microshiftUpgrade cri-oUpgrade podmanUpgrade skopeoUpgrade openshift-clientsUpgrade openshift | Mar 31, 2023 | Nov 30, 2022 |
| Redhat_linux | — | Upgrade podman-pluginsUpgrade cockpit-composerUpgrade libslirp-develUpgrade container-selinuxUpgrade osbuild-selinuxUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade delve-debuginfoUpgrade buildah-debugsourceUpgrade osbuild-ostreeUpgrade skopeo-testsUpgrade weldr-client-debugsourceUpgrade slirp4netns-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade criu-libsUpgrade grafana-debugsourceUpgrade toolbox-debuginfoUpgrade go-toolsetUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade python3-criuUpgrade crun-debuginfoUpgrade git-lfs-debugsourceUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade crunUpgrade osbuild-composer-workerUpgrade osbuild-composer-core-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade weldr-clientUpgrade osbuild-composer-debuginfoUpgrade delveUpgrade git-lfsUpgrade golang-docsUpgrade libslirp-debuginfoUpgrade weldr-client-debuginfoUpgrade grafanaUpgrade podman-plugins-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade libslirpUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade osbuild-lvm2Upgrade osbuild-composerUpgrade golang-srcUpgrade podman-catatonitUpgrade weldr-client-tests-debuginfoUpgrade toolbox-debugsourceUpgrade podmanUpgrade golangUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade buildahUpgrade runcUpgrade python3-podmanUpgrade osbuild-luks2Upgrade skopeo-debuginfoUpgrade critUpgrade toolbox-testsUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade grafana-debuginfoUpgrade git-lfs-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade podman-testsUpgrade podman-remoteUpgrade skopeoUpgrade python3-osbuildUpgrade criu-libs-debuginfoNo solution existsUpgrade golang-testsUpgrade delve-debugsourceUpgrade netavarkUpgrade criu-debugsourceUpgrade golang-raceUpgrade skopeo-debugsourceUpgrade toolboxUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade podman-gvproxyUpgrade osbuild-composer-debugsourceUpgrade udicaUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade golang-binUpgrade buildah-testsUpgrade criuUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade osbuildUpgrade golang-miscUpgrade osbuild-composer-worker-debuginfoUpgrade conmon-debuginfoUpgrade osbuild-composer-coreUpgrade aardvark-dns | May 5, 2023 | Dec 8, 2022 |
| Rocky_linux | — | Upgrade criu-debuginfoUpgrade libdb-cxxUpgrade libslirp-develUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade criu-libs-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade libdb-debugsourceUpgrade criu-develUpgrade libslirpUpgrade criuUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade crit | Mar 5, 2024 | Dec 8, 2022 |
| Suse | — | Upgrade go1.18-openssl-docUpgrade go1.18-raceUpgrade go1.19-raceUpgrade go1.18Upgrade go1.19Upgrade go1.18-docUpgrade go1.18-opensslUpgrade go1.19-docUpgrade go1.18-openssl-race | Dec 12, 2022 | Dec 8, 2022 |
| Ubuntu | — | Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.16-srcUpgrade golang-1.18Upgrade golang-1.18-srcUpgrade golang-1.18-go | May 1, 2023 | Dec 8, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub