| modules: |
| - module: std |
| versions: |
| - fixed: 1.15.12 |
| - introduced: 1.16.0 |
| fixed: 1.16.4 |
| vulnerable_at: 1.16.3 |
| packages: |
| - package: net/http |
| symbols: |
| - http2clientStream.writeRequest |
| - http2isConnectionCloseRequest |
| - isProtocolSwitchHeader |
| - shouldClose |
| - module: golang.org/x/net |
| versions: |
| - fixed: 0.0.0-20210428140749-89ef3d95e781 |
| vulnerable_at: 0.0.0-20210427231257-85d9c07bbe3a |
| packages: |
| - package: golang.org/x/net/http/httpguts |
| symbols: |
| - headerValueContainsToken |
| derived_symbols: |
| - HeaderValuesContainsToken |
| description: | |
| A malicious HTTP server or client can cause the net/http client |
| or server to panic. |
| |
| ReadRequest and ReadResponse can hit an unrecoverable panic |
| when reading a very large header (over 7MB on 64-bit architectures, |
| or over 4MB on 32-bit ones). Transport and Client are vulnerable |
| and the program can be made to crash by a malicious server. |
| Server is not vulnerable by default, but can be if the default |
| max header of 1MB is overridden by setting Server.MaxHeaderBytes |
| to a higher value, in which case the program can be made to |
| crash by a malicious client. |
| |
| This also affects golang.org/x/net/http2/h2c and |
| HeaderValuesContainsToken in golang.org/x/net/http/httpguts. |
| published: 2022-07-15T23:04:18Z |
| cves: |
| - CVE-2021-31525 |
| credit: Guido Vranken |
| references: |
| - fix: https://go.dev/cl/313069 |
| - fix: https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9 |
| - report: https://go.dev/issue/45710 |
| - web: https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc |
