HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade conmonUpgrade podman-gvproxyUpgrade udicaUpgrade critUpgrade toolbox-testsUpgrade criuUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade podman-testsUpgrade netavarkUpgrade podmanUpgrade podman-remoteUpgrade skopeoUpgrade aardvark-dnsUpgrade toolboxUpgrade runcUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade buildahUpgrade podman-dockerUpgrade libslirp-develUpgrade container-selinuxUpgrade criu-develUpgrade skopeo-testsUpgrade python3-criuUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade grafanaUpgrade crunUpgrade containers-commonUpgrade criu-libsUpgrade libslirp | Nov 16, 2023 | Apr 6, 2023 |
| Alpine Linux | — | Upgrade nomadUpgrade traefikUpgrade go | Aug 22, 2024 | Apr 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golangUpgrade golang-miscUpgrade golang-raceUpgrade golang-srcUpgrade golang-sharedUpgrade containerdUpgrade golang-testsUpgrade containerd-debuginfoUpgrade golang-docsUpgrade containerd-stressUpgrade golang-bin | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux | — | Upgrade golang | Apr 21, 2023 | Apr 6, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-docsUpgrade golang-binUpgrade golang-miscUpgrade golang-srcUpgrade golang-testsUpgrade golangUpgrade golang-race | Feb 17, 2025 | Apr 4, 2023 |
| Centos_linux | — | Upgrade podmanUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade criu-libs-debuginfoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxyUpgrade podman-gvproxy-debuginfoUpgrade aardvark-dnsUpgrade libslirp-debuginfoUpgrade golangUpgrade golang-docsUpgrade grafana-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade toolbox-debuginfoUpgrade skopeoUpgrade slirp4netnsUpgrade podman-catatonitUpgrade podman-debuginfoUpgrade conmon-debugsourceUpgrade golang-binUpgrade toolboxUpgrade podman-dockerUpgrade skopeo-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade critUpgrade cockpit-podmanUpgrade golang-testsUpgrade fuse-overlayfsUpgrade buildahUpgrade runcUpgrade criuUpgrade udicaUpgrade containernetworking-pluginsUpgrade delve-debugsourceUpgrade podman-testsUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade grafana-debugsourceUpgrade container-selinuxUpgrade delve-debuginfoUpgrade buildah-tests-debuginfoUpgrade criu-libsUpgrade containernetworking-plugins-debuginfoUpgrade python3-podmanUpgrade crun-debuginfoUpgrade conmonUpgrade crun-debugsourceUpgrade libslirp-debugsourceUpgrade golang-raceUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade golang-srcUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade go-toolsetUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-testsUpgrade criu-develUpgrade runc-debuginfoUpgrade libslirp-develUpgrade grafanaUpgrade golang-miscUpgrade delveUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade conmon-debuginfoUpgrade podman-plugins-debuginfo | Oct 23, 2023 | Apr 6, 2023 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Apr 6, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120Upgrade traefik | Apr 14, 2023 | Apr 7, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jul 18, 2023 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Apr 6, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jul 10, 2023 | Apr 6, 2023 |
| Oracle_linux | — | Upgrade containers-commonUpgrade podman-pluginsUpgrade critUpgrade libslirp-develUpgrade skopeo-testsUpgrade netavarkUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade criuUpgrade runcUpgrade skopeoUpgrade podmanUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade criu-develUpgrade grafanaUpgrade aardvark-dnsUpgrade udicaUpgrade libslirpUpgrade podman-testsUpgrade podman-gvproxyUpgrade python3-podmanUpgrade container-selinuxUpgrade slirp4netnsUpgrade buildah-testsUpgrade python3-criuUpgrade conmonUpgrade podman-dockerUpgrade buildahUpgrade cockpit-podmanUpgrade crun | Nov 16, 2023 | Apr 4, 2023 |
| Redhat Openshift | — | Upgrade kernel-rtUpgrade openstack-ironicUpgrade podmanUpgrade buildahUpgrade cri-oUpgrade openshift-clientsUpgrade openshiftUpgrade microshiftUpgrade cri-toolsUpgrade kernelUpgrade skopeoUpgrade conmon | Jun 15, 2023 | Apr 4, 2023 |
| Redhat_linux | — | Upgrade python3-criuUpgrade criu-develUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade runcUpgrade slirp4netns-debugsourceUpgrade podman-debuginfoUpgrade podman-testsUpgrade toolboxUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade golang-docsUpgrade crun-debugsourceUpgrade podman-debugsourceUpgrade skopeoUpgrade grafana-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade udicaUpgrade skopeo-testsUpgrade conmonUpgrade grafanaUpgrade container-selinuxUpgrade containers-commonUpgrade criu-libsUpgrade crun-debuginfoUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade delveUpgrade crunUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade oci-seccomp-bpf-hookUpgrade golang-binUpgrade critUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-pluginsUpgrade podman-gvproxy-debuginfoUpgrade delve-debuginfoUpgrade buildah-testsUpgrade toolbox-testsUpgrade buildah-tests-debuginfoUpgrade golang-testsUpgrade golangUpgrade podman-catatonitUpgrade buildah-debuginfoUpgrade golang-srcUpgrade netavarkUpgrade conmon-debugsourceUpgrade podmanUpgrade runc-debugsourceUpgrade grafana-debuginfoNo solution existsUpgrade containernetworking-pluginsUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade slirp4netnsUpgrade golang-raceUpgrade golang-miscUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade podman-remoteUpgrade skopeo-debuginfoUpgrade cockpit-podmanUpgrade criu-debugsourceUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade podman-dockerUpgrade python3-podmanUpgrade podman-gvproxy | Oct 23, 2023 | Apr 6, 2023 |
| Rocky_linux | — | Upgrade libslirpUpgrade podman-testsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debugsourceUpgrade buildahUpgrade podman-pluginsUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade criu-debuginfoUpgrade podmanUpgrade conmonUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade podman-remote-debuginfoUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade python3-criuUpgrade libslirp-develUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade criu-libsUpgrade criu-libs-debuginfoUpgrade runcUpgrade criu-debugsourceUpgrade slirp4netnsUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade buildah-testsUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade criu-develUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfo | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade go1.20-raceUpgrade go1.19-raceUpgrade go1.20Upgrade go1.19-docUpgrade go1.20-docUpgrade go1.19 | Apr 10, 2023 | Apr 6, 2023 |
| Ubuntu | — | Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.20-goUpgrade golang-1.16-srcUpgrade golang-1.18Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.19-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.19-goUpgrade golang-1.13Upgrade golang-1.20Upgrade golang-1.19Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.20-srcUpgrade golang-1.18-srcUpgrade golang-1.16 | May 1, 2023 | Apr 6, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub