An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-workerUpgrade python3-criuUpgrade osbuild-composer-dnf-jsonUpgrade skopeo-testsUpgrade container-selinuxUpgrade libslirp-develUpgrade conmonUpgrade udicaUpgrade weldr-clientUpgrade runcUpgrade crunUpgrade skopeoUpgrade podman-testsUpgrade toolboxUpgrade libslirpUpgrade critUpgrade podman-pluginsUpgrade git-lfsUpgrade criu-develUpgrade grafanaUpgrade podman-dockerUpgrade podmanUpgrade python3-podmanUpgrade netavarkUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade criu-libsUpgrade buildah-testsUpgrade toolbox-testsUpgrade osbuild-composerUpgrade cockpit-podmanUpgrade criuUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade buildahUpgrade containers-commonUpgrade aardvark-dnsUpgrade osbuild-composer-coreUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade podman-remote | May 15, 2023 | Dec 8, 2022 |
| Alpine Linux | — | Upgrade minio-clientUpgrade go | Aug 22, 2024 | Dec 8, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade golang-docsUpgrade golang-testsUpgrade golang-sharedUpgrade golang-binUpgrade golangUpgrade golang-srcUpgrade golang-misc | Feb 7, 2023 | Dec 8, 2022 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Oct 20, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-raceUpgrade golang-srcUpgrade golang-sharedUpgrade golangUpgrade golang-misc | Feb 17, 2025 | Nov 30, 2022 |
| Centos_linux | — | Upgrade foreman_ygg_workerUpgrade puppet-agentUpgrade yggdrasil | May 5, 2023 | Dec 8, 2022 |
| Debian | — | Upgrade golang-1.19Upgrade golang-golang-x-net | Jul 30, 2024 | Dec 8, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Dec 7, 2022 | Dec 6, 2022 |
| Gentoo Linux | — | Upgrade app-containers/docker.Upgrade app-admin/consul.Upgrade dev-lang/go. | Nov 27, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 20, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 24, 2023 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Jan 10, 2024 | Dec 8, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 9, 2023 | Dec 8, 2022 |
| Oracle_linux | — | Upgrade criuUpgrade criu-develUpgrade weldr-clientUpgrade podman-remoteUpgrade python3-criuUpgrade delveUpgrade golang-binUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade critUpgrade crunUpgrade golang-testsUpgrade buildah-testsUpgrade podman-pluginsUpgrade osbuildUpgrade skopeo-testsUpgrade osbuild-composer-workerUpgrade udicaUpgrade podman-dockerUpgrade podmanUpgrade cockpit-composerUpgrade golang-docsUpgrade podman-catatonitUpgrade osbuild-composerUpgrade runcUpgrade skopeoUpgrade containers-commonUpgrade podman-testsUpgrade osbuild-luks2Upgrade git-lfsUpgrade golang-srcUpgrade golang-raceUpgrade osbuild-ostreeUpgrade libslirpUpgrade libslirp-develUpgrade osbuild-composer-dnf-jsonUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade buildahUpgrade osbuild-lvm2Upgrade golang-miscUpgrade python3-osbuildUpgrade grafanaUpgrade golangUpgrade fuse-overlayfsUpgrade go-toolsetUpgrade osbuild-composer-coreUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade criu-libsUpgrade python3-podmanUpgrade podman-gvproxyUpgrade osbuild-selinux | Mar 8, 2023 | Nov 30, 2022 |
| Redhat Openshift | — | Upgrade microshiftUpgrade windows-machine-config-rhel9-operatorUpgrade cri-oUpgrade openshiftUpgrade podmanUpgrade openshift-clientsUpgrade skopeo | Mar 31, 2023 | Nov 30, 2022 |
| Redhat_linux | — | Upgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade osbuild-composer-coreUpgrade podmanUpgrade golang-miscUpgrade conmon-debuginfoUpgrade podman-dockerUpgrade toolboxUpgrade toolbox-debugsourceUpgrade buildah-debuginfoUpgrade golang-testsUpgrade podman-testsUpgrade runcUpgrade udicaUpgrade buildah-tests-debuginfoUpgrade criu-libs-debuginfoUpgrade python3-podmanUpgrade osbuild-luks2Upgrade golang-raceUpgrade critUpgrade golang-srcUpgrade osbuild-composer-debugsourceUpgrade golang-binUpgrade osbuild-composer-worker-debuginfoUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade skopeoUpgrade netavarkUpgrade conmon-debugsourceUpgrade delve-debugsourceUpgrade criuUpgrade skopeo-debuginfoUpgrade toolbox-testsUpgrade criu-debugsourceUpgrade conmonUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade golangUpgrade buildahUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade podman-remoteUpgrade weldr-client-tests-debuginfoUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade git-lfs-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade grafana-debuginfoUpgrade podman-debuginfoUpgrade osbuild-composerNo solution existsUpgrade criu-debuginfoUpgrade python3-osbuildUpgrade osbuildUpgrade crunUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debugsourceUpgrade golang-docsUpgrade podman-plugins-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade weldr-clientUpgrade skopeo-testsUpgrade libslirpUpgrade osbuild-composer-dnf-jsonUpgrade cockpit-composerUpgrade osbuild-composer-workerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade git-lfs-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade podman-pluginsUpgrade osbuild-composer-debuginfoUpgrade osbuild-ostreeUpgrade python3-criuUpgrade libslirp-develUpgrade toolbox-debuginfoUpgrade container-selinuxUpgrade crun-debuginfoUpgrade osbuild-lvm2Upgrade criu-libsUpgrade go-toolsetUpgrade weldr-client-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delve-debuginfoUpgrade weldr-client-debuginfoUpgrade osbuild-selinuxUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade grafanaUpgrade crun-debugsourceUpgrade grafana-debugsourceUpgrade delveUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-core-debuginfoUpgrade git-lfs | May 5, 2023 | Dec 8, 2022 |
| Rocky_linux | — | Upgrade criu-libsUpgrade libdb-cxxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-develUpgrade criu-debuginfoUpgrade libdb-utils-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libdb-cxx-debuginfoUpgrade criuUpgrade libdb-sql-devel-debuginfoUpgrade libslirp-debuginfoUpgrade libdb-debugsourceUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade critUpgrade libslirpUpgrade criu-devel | Mar 5, 2024 | Dec 8, 2022 |
| Suse | — | Upgrade go1.19Upgrade go1.18-docUpgrade go1.19-docUpgrade go1.18-opensslUpgrade go1.18-openssl-raceUpgrade go1.18-openssl-docUpgrade go1.18Upgrade go1.18-raceUpgrade go1.19-race | Dec 12, 2022 | Dec 8, 2022 |
| Ubuntu | — | Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.16-srcUpgrade golang-1.16-goUpgrade golang-1.16Upgrade golang-1.18Upgrade golang-1.18-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro) | May 1, 2023 | Dec 8, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub