HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade crunUpgrade libslirp-develUpgrade grafanaUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade criu-develUpgrade podman-pluginsUpgrade python3-criuUpgrade criu-libsUpgrade containers-commonUpgrade libslirpUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade critUpgrade cockpit-podmanUpgrade criuUpgrade slirp4netnsUpgrade udicaUpgrade aardvark-dnsUpgrade netavarkUpgrade podman-dockerUpgrade podman-testsUpgrade podman-catatonitUpgrade python3-podmanUpgrade podman-gvproxyUpgrade conmonUpgrade runcUpgrade containernetworking-pluginsUpgrade skopeoUpgrade buildahUpgrade podmanUpgrade toolboxUpgrade podman-remoteUpgrade buildah-testsUpgrade toolbox-tests | Nov 16, 2023 | Apr 6, 2023 |
| Alpine Linux | — | Upgrade traefikUpgrade goUpgrade nomad | Aug 22, 2024 | Apr 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade containerd-stressUpgrade golang-binUpgrade containerd-debuginfoUpgrade golang-testsUpgrade golang-docsUpgrade containerdUpgrade golang-srcUpgrade golangUpgrade golang-raceUpgrade golang-misc | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-binUpgrade golang-docsUpgrade golang-testsUpgrade golang-miscUpgrade golang-srcUpgrade golang-raceUpgrade golang | Feb 17, 2025 | Apr 4, 2023 |
| Centos_linux | — | Upgrade golang-docsUpgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade golangUpgrade libslirp-debuginfoUpgrade udicaUpgrade aardvark-dnsUpgrade fuse-overlayfs-debuginfoUpgrade podman-gvproxyUpgrade delve-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade crunUpgrade grafana-debuginfoUpgrade podman-catatonitUpgrade podman-debuginfoUpgrade criuUpgrade cockpit-podmanUpgrade buildahUpgrade criu-debuginfoUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade skopeo-debugsourceUpgrade runcUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-testsUpgrade skopeoUpgrade toolbox-testsUpgrade podman-dockerUpgrade runc-debugsourceUpgrade critUpgrade netavarkUpgrade golang-testsUpgrade toolboxUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade golang-binUpgrade buildah-tests-debuginfoUpgrade criu-develUpgrade go-toolsetUpgrade python3-podmanUpgrade libslirp-develUpgrade grafana-debugsourceUpgrade criu-debugsourceUpgrade container-selinuxUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remote-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade golang-srcUpgrade containers-commonUpgrade grafanaUpgrade golang-miscUpgrade delveUpgrade conmon-debuginfoUpgrade runc-debuginfoUpgrade golang-raceUpgrade criu-libsUpgrade python3-criuUpgrade crun-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade delve-debuginfoUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade conmon | Oct 23, 2023 | Apr 6, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Apr 6, 2023 |
| Freebsd | — | Upgrade go120Upgrade traefikUpgrade go119 | Apr 14, 2023 | Apr 7, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jul 18, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jul 10, 2023 | Apr 6, 2023 |
| Oracle_linux | — | Upgrade podmanUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade netavarkUpgrade criu-libsUpgrade skopeo-testsUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade critUpgrade libslirp-develUpgrade podman-pluginsUpgrade skopeoUpgrade criu-develUpgrade containernetworking-pluginsUpgrade criuUpgrade slirp4netnsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade buildahUpgrade conmonUpgrade cockpit-podmanUpgrade container-selinuxUpgrade python3-podmanUpgrade podman-dockerUpgrade podman-testsUpgrade libslirpUpgrade crunUpgrade udicaUpgrade python3-criuUpgrade grafanaUpgrade aardvark-dns | Nov 16, 2023 | Apr 4, 2023 |
| Redhat Openshift | — | Upgrade microshiftUpgrade conmonUpgrade kernelUpgrade cri-toolsUpgrade openshiftUpgrade openshift-clientsUpgrade skopeoUpgrade cri-oUpgrade buildahUpgrade podmanUpgrade openstack-ironicUpgrade kernel-rt | Jun 15, 2023 | Apr 4, 2023 |
| Redhat_linux | — | Upgrade grafanaUpgrade skopeo-testsUpgrade python3-criuUpgrade criu-develUpgrade libslirp-debuginfoUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade delveUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debugsourceUpgrade buildah-debugsourceUpgrade delve-debugsourceUpgrade containers-commonUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade toolboxUpgrade crun-debuginfoUpgrade libslirp-develUpgrade toolbox-debuginfoUpgrade conmonUpgrade golang-binUpgrade runc-debuginfoUpgrade podman-catatonit-debuginfoUpgrade udicaUpgrade go-toolsetUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeoUpgrade slirp4netns-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-testsUpgrade criu-libsUpgrade grafana-debugsourceUpgrade libslirpUpgrade golang-docsUpgrade podman-pluginsUpgrade runcUpgrade crunUpgrade cockpit-podmanUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade golang-testsUpgrade golang-srcUpgrade podmanUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade podman-dockerUpgrade netavarkUpgrade python3-podmanUpgrade podman-gvproxyUpgrade containernetworking-pluginsUpgrade conmon-debuginfoUpgrade skopeo-debuginfoUpgrade buildah-tests-debuginfoUpgrade grafana-debuginfoUpgrade toolbox-testsUpgrade golang-miscUpgrade golang-raceUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netnsUpgrade criuUpgrade buildahNo solution existsUpgrade aardvark-dnsUpgrade criu-debugsourceUpgrade skopeo-debugsourceUpgrade podman-catatonitUpgrade podman-remoteUpgrade delve-debuginfoUpgrade buildah-testsUpgrade golangUpgrade fuse-overlayfs | Oct 23, 2023 | Apr 6, 2023 |
| Rocky_linux | — | Upgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade criu-libsUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade criu-libs-debuginfoUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade runcUpgrade podman-gvproxyUpgrade podman-remoteUpgrade podman-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade crun-debuginfoUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade critUpgrade buildah-testsUpgrade slirp4netnsUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade runc-debugsourceUpgrade criu-develUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade podman-pluginsUpgrade buildah-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-testsUpgrade libslirpUpgrade podmanUpgrade criuUpgrade crun-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade buildah-debuginfo | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade go1.19-docUpgrade go1.19Upgrade go1.20-docUpgrade go1.20Upgrade go1.20-raceUpgrade go1.19-race | Apr 10, 2023 | Apr 6, 2023 |
| Ubuntu | — | Upgrade golang-1.19Upgrade golang-1.20-srcUpgrade golang-1.20Upgrade golang-1.18-srcUpgrade golang-1.16Upgrade golang-1.13Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.13-srcUpgrade golang-1.16-goUpgrade golang-1.18Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.19-goUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.20-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.19-src | May 1, 2023 | Apr 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub