| id: GO-2022-0236 |
| modules: |
| - module: std |
| versions: |
| - fixed: 1.15.12 |
| - introduced: 1.16.0-0 |
| fixed: 1.16.4 |
| vulnerable_at: 1.16.3 |
| packages: |
| - package: net/http |
| symbols: |
| - http2clientStream.writeRequest |
| - http2isConnectionCloseRequest |
| - isProtocolSwitchHeader |
| - shouldClose |
| - module: golang.org/x/net |
| versions: |
| - fixed: 0.0.0-20210428140749-89ef3d95e781 |
| vulnerable_at: 0.0.0-20210427231257-85d9c07bbe3a |
| packages: |
| - package: golang.org/x/net/http/httpguts |
| symbols: |
| - headerValueContainsToken |
| derived_symbols: |
| - HeaderValuesContainsToken |
| summary: Panic due to large headers in net/http and golang.org/x/net/http/httpguts |
| description: |- |
| A malicious HTTP server or client can cause the net/http client or server to |
| panic. |
| |
| ReadRequest and ReadResponse can hit an unrecoverable panic when reading a very |
| large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). |
| Transport and Client are vulnerable and the program can be made to crash by a |
| malicious server. Server is not vulnerable by default, but can be if the default |
| max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher |
| value, in which case the program can be made to crash by a malicious client. |
| |
| This also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in |
| golang.org/x/net/http/httpguts. |
| published: 2022-07-15T23:04:18Z |
| cves: |
| - CVE-2021-31525 |
| ghsas: |
| - GHSA-h86h-8ppg-mxmh |
| credits: |
| - Guido Vranken |
| references: |
| - fix: https://go.dev/cl/313069 |
| - fix: https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9 |
| - report: https://go.dev/issue/45710 |
| - web: https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc |
| review_status: REVIEWED |
