HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-dockerUpgrade toolboxUpgrade conmonUpgrade podman-testsUpgrade buildahUpgrade skopeoUpgrade python3-podmanUpgrade udicaUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade podmanUpgrade podman-catatonitUpgrade criuUpgrade slirp4netnsUpgrade netavarkUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade buildah-testsUpgrade toolbox-testsUpgrade podman-remoteUpgrade critUpgrade runcUpgrade criu-libsUpgrade libslirp-develUpgrade skopeo-testsUpgrade criu-develUpgrade crunUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade grafanaUpgrade containers-commonUpgrade libslirpUpgrade container-selinux | Nov 16, 2023 | Apr 6, 2023 |
| Alpine Linux | — | Upgrade traefikUpgrade goUpgrade nomad | Aug 22, 2024 | Apr 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-raceUpgrade golang-srcUpgrade golangUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade golang-binUpgrade golang-docsUpgrade containerdUpgrade containerd-stressUpgrade golang-tests | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-docsUpgrade golang-binUpgrade golang-miscUpgrade golang-testsUpgrade golang-srcUpgrade golang-raceUpgrade golang | Feb 17, 2025 | Apr 4, 2023 |
| Centos_linux | — | Upgrade delveUpgrade podman-plugins-debuginfoUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade criu-develUpgrade container-selinuxUpgrade libslirp-debugsourceUpgrade golang-miscUpgrade grafanaUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade libslirp-develUpgrade podman-debugsourceUpgrade runc-debuginfoUpgrade conmon-debuginfoUpgrade grafana-debugsourceUpgrade slirp4netns-debuginfoUpgrade python3-podmanUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-raceUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade golang-srcUpgrade conmonUpgrade delve-debuginfoUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade go-toolsetUpgrade criu-libsUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade podman-gvproxyUpgrade netavarkUpgrade containernetworking-pluginsUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade runc-debugsourceUpgrade golang-binUpgrade aardvark-dnsUpgrade delve-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade skopeo-debugsourceUpgrade runcUpgrade podman-remoteUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade buildahUpgrade skopeoUpgrade golang-testsUpgrade fuse-overlayfsUpgrade critUpgrade cockpit-podmanUpgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade libslirp-debuginfoUpgrade udicaUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade grafana-debuginfoUpgrade golang-docsUpgrade conmon-debugsourceUpgrade golangUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade podman-catatonitUpgrade criuUpgrade toolbox-debugsourceUpgrade podman-dockerUpgrade criu-debuginfoUpgrade podman-tests | Oct 23, 2023 | Apr 6, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Apr 6, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120Upgrade traefik | Apr 14, 2023 | Apr 7, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jul 18, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jul 10, 2023 | Apr 6, 2023 |
| Oracle_linux | — | Upgrade podmanUpgrade libslirp-develUpgrade criu-develUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade podman-pluginsUpgrade netavarkUpgrade criuUpgrade skopeo-testsUpgrade skopeoUpgrade criu-libsUpgrade containers-commonUpgrade critUpgrade conmonUpgrade podman-testsUpgrade udicaUpgrade libslirpUpgrade crunUpgrade buildahUpgrade aardvark-dnsUpgrade grafanaUpgrade buildah-testsUpgrade python3-criuUpgrade python3-podmanUpgrade container-selinuxUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade podman-dockerUpgrade cockpit-podman | Nov 16, 2023 | Apr 4, 2023 |
| Redhat Openshift | — | Upgrade kernel-rtUpgrade podmanUpgrade buildahUpgrade openstack-ironicUpgrade cri-toolsUpgrade kernelUpgrade openshiftUpgrade conmonUpgrade openshift-clientsUpgrade skopeoUpgrade microshiftUpgrade cri-o | Jun 15, 2023 | Apr 4, 2023 |
| Redhat_linux | — | Upgrade podman-debuginfoUpgrade criu-develUpgrade podman-catatonit-debuginfoUpgrade delve-debugsourceUpgrade criu-libs-debuginfoUpgrade buildah-debugsourceUpgrade conmonUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade grafanaUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade runc-debuginfoUpgrade delveUpgrade podman-plugins-debuginfoUpgrade podman-testsUpgrade grafana-debugsourceUpgrade udicaUpgrade go-toolsetUpgrade golang-binUpgrade podman-gvproxy-debuginfoUpgrade skopeoUpgrade podman-pluginsUpgrade runcUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade crunUpgrade golang-docsUpgrade criu-libsUpgrade critUpgrade libslirp-debugsourceUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade containers-commonUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debugsourceUpgrade toolboxUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade golang-testsUpgrade golang-srcUpgrade podmanUpgrade fuse-overlayfsUpgrade delve-debuginfoUpgrade skopeo-debugsourceUpgrade podman-remoteUpgrade buildah-debuginfoUpgrade aardvark-dnsUpgrade golangUpgrade podman-catatonitUpgrade buildah-testsUpgrade grafana-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netnsUpgrade criuUpgrade podman-dockerUpgrade cockpit-podmanUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade golang-miscUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade golang-raceUpgrade criu-debugsourceUpgrade toolbox-testsNo solution existsUpgrade skopeo-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade netavarkUpgrade python3-podmanUpgrade buildah | Oct 23, 2023 | Apr 6, 2023 |
| Rocky_linux | — | Upgrade slirp4netns-debugsourceUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade crun-debuginfoUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade python3-criuUpgrade runcUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containers-commonUpgrade buildah-testsUpgrade criu-debugsourceUpgrade libslirp-develUpgrade critUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade criu-develUpgrade conmon-debuginfoUpgrade criu-libsUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade fuse-overlayfsUpgrade podman-testsUpgrade buildahUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-pluginsUpgrade crunUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade podmanUpgrade criu-debuginfoUpgrade conmonUpgrade libslirpUpgrade podman-remote-debuginfoUpgrade podman-catatonit | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade go1.19-raceUpgrade go1.20-raceUpgrade go1.20Upgrade go1.19Upgrade go1.20-docUpgrade go1.19-doc | Apr 10, 2023 | Apr 6, 2023 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.13-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.20Upgrade golang-1.19Upgrade golang-1.16Upgrade golang-1.13Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.20-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.20-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.19-goUpgrade golang-1.19-srcUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.13-go | May 1, 2023 | Apr 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub