HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criu-develUpgrade libslirpUpgrade python3-criuUpgrade container-selinuxUpgrade skopeo-testsUpgrade criu-libsUpgrade grafanaUpgrade crunUpgrade libslirp-develUpgrade podman-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade conmonUpgrade buildahUpgrade podmanUpgrade fuse-overlayfsUpgrade skopeoUpgrade containernetworking-pluginsUpgrade runcUpgrade aardvark-dnsUpgrade toolboxUpgrade buildah-testsUpgrade podman-dockerUpgrade critUpgrade criuUpgrade netavarkUpgrade udicaUpgrade slirp4netnsUpgrade podman-testsUpgrade python3-podmanUpgrade podman-remoteUpgrade podman-catatonitUpgrade podman-gvproxy | Nov 16, 2023 | Apr 6, 2023 |
| Alpine Linux | — | Upgrade traefikUpgrade goUpgrade nomad | Aug 22, 2024 | Apr 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade containerd-stressUpgrade golang-binUpgrade golang-docsUpgrade containerdUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade golang-testsUpgrade golang-raceUpgrade golang-srcUpgrade golangUpgrade golang-misc | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-raceUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golang-srcUpgrade golang-miscUpgrade golang-shared | Feb 17, 2025 | Apr 4, 2023 |
| Centos_linux | — | Upgrade golang-srcUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade criu-develUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade golang-raceUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade container-selinuxUpgrade podman-pluginsUpgrade golang-miscUpgrade go-toolsetUpgrade grafana-debugsourceUpgrade delveUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade conmonUpgrade crun-debuginfoUpgrade libslirp-develUpgrade python3-criuUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade delve-debuginfoUpgrade grafanaUpgrade python3-podmanUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade skopeo-testsUpgrade containers-commonUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade delve-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade critUpgrade golang-testsUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade crunUpgrade runcUpgrade skopeo-debugsourceUpgrade skopeoUpgrade toolboxUpgrade podman-remoteUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade buildahUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade criu-debuginfoUpgrade podman-debuginfoUpgrade criuUpgrade toolbox-debugsourceUpgrade podman-dockerUpgrade cockpit-podmanUpgrade golangUpgrade toolbox-debuginfoUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade grafana-debuginfoUpgrade golang-docsUpgrade conmon-debugsourceUpgrade udicaUpgrade libslirp-debuginfoUpgrade golang-binUpgrade containernetworking-plugins-debugsourceUpgrade aardvark-dns | Oct 23, 2023 | Apr 6, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Apr 6, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120Upgrade traefik | Apr 14, 2023 | Apr 7, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jul 18, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 10, 2024 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jul 10, 2023 | Apr 6, 2023 |
| Oracle_linux | — | Upgrade grafanaUpgrade aardvark-dnsUpgrade udicaUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade libslirpUpgrade buildahUpgrade conmonUpgrade crunUpgrade podman-testsUpgrade cockpit-podmanUpgrade podman-dockerUpgrade container-selinuxUpgrade python3-criuUpgrade python3-podmanUpgrade buildah-testsUpgrade critUpgrade libslirp-develUpgrade podmanUpgrade criuUpgrade criu-libsUpgrade criu-develUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade skopeoUpgrade podman-pluginsUpgrade netavarkUpgrade skopeo-testsUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade podman-remote | Nov 16, 2023 | Apr 4, 2023 |
| Redhat Openshift | — | Upgrade skopeoUpgrade openshift-clientsUpgrade cri-toolsUpgrade openshiftUpgrade microshiftUpgrade cri-oUpgrade kernelUpgrade conmonUpgrade buildahUpgrade openstack-ironicUpgrade kernel-rtUpgrade podman | Jun 15, 2023 | Apr 4, 2023 |
| Redhat_linux | — | Upgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade podman-gvproxyUpgrade python3-podmanUpgrade netavarkUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade toolbox-testsUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade buildah-testsUpgrade podman-dockerUpgrade golang-miscUpgrade golang-raceUpgrade golangUpgrade buildahUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade grafana-debuginfoNo solution existsUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade cockpit-podmanUpgrade golang-srcUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade podmanUpgrade runc-debugsourceUpgrade golang-testsUpgrade skopeo-debugsourceUpgrade delve-debuginfoUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade criu-develUpgrade podman-debuginfoUpgrade critUpgrade crunUpgrade crun-debugsourceUpgrade delveUpgrade delve-debugsourceUpgrade libslirp-debugsourceUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade go-toolsetUpgrade udicaUpgrade runcUpgrade podman-pluginsUpgrade skopeoUpgrade grafana-debugsourceUpgrade golang-binUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade grafanaUpgrade libslirpUpgrade podman-testsUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade criu-libsUpgrade conmonUpgrade podman-catatonit-debuginfoUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade libslirp-develUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debugsourceUpgrade criu-libs-debuginfoUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade golang-docsUpgrade toolbox-debugsourceUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade python3-criu | Oct 23, 2023 | Apr 6, 2023 |
| Rocky_linux | — | Upgrade podman-pluginsUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade libslirpUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade conmonUpgrade netavarkUpgrade criu-debuginfoUpgrade podman-catatonitUpgrade podman-remote-debuginfoUpgrade podmanUpgrade podman-testsUpgrade crun-debugsourceUpgrade fuse-overlayfsUpgrade crunUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade libslirp-debuginfoUpgrade criu-develUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade criu-libsUpgrade libslirp-develUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade runcUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade slirp4netns | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade go1.20-docUpgrade go1.19Upgrade go1.20Upgrade go1.19-docUpgrade go1.19-raceUpgrade go1.20-race | Apr 10, 2023 | Apr 6, 2023 |
| Ubuntu | — | Upgrade golang-1.18Upgrade golang-1.19-goUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.20-goUpgrade golang-1.16-srcUpgrade golang-1.13-goUpgrade golang-1.19-srcUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.20Upgrade golang-1.20-srcUpgrade golang-1.18-srcUpgrade golang-1.13-srcUpgrade golang-1.16-goUpgrade golang-1.19Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13 | May 1, 2023 | Apr 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub