packages:
  - module: std
    package: net/http
    symbols:
      - http2clientStream.writeRequest
      - http2isConnectionCloseRequest
      - isProtocolSwitchHeader
      - shouldClose
    versions:
      - fixed: 1.15.12
      - introduced: 1.16.0
        fixed: 1.16.4
    vulnerable_at: 1.16.3
  - module: golang.org/x/net
    package: golang.org/x/net/http/httpguts
    symbols:
      - headerValueContainsToken
    derived_symbols:
      - HeaderValuesContainsToken
    versions:
      - fixed: 0.0.0-20210428140749-89ef3d95e781
    vulnerable_at: 0.0.0-20210427231257-85d9c07bbe3a
description: |
    A malicious HTTP server or client can cause the net/http client
    or server to panic.

    ReadRequest and ReadResponse can hit an unrecoverable panic
    when reading a very large header (over 7MB on 64-bit architectures,
    or over 4MB on 32-bit ones). Transport and Client are vulnerable
    and the program can be made to crash by a malicious server.
    Server is not vulnerable by default, but can be if the default
    max header of 1MB is overridden by setting Server.MaxHeaderBytes
    to a higher value, in which case the program can be made to
    crash by a malicious client.

    This also affects golang.org/x/net/http2/h2c and
    HeaderValuesContainsToken in golang.org/x/net/http/httpguts.
cves:
  - CVE-2021-31525
credit: Guido Vranken
links:
    pr: https://go.dev/cl/313069
    commit: https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9
    context:
      - https://go.dev/issue/45710
      - https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc