| id: GO-2022-0536 |
| modules: |
| - module: std |
| versions: |
| - fixed: 1.11.13 |
| - introduced: 1.12.0-0 |
| - fixed: 1.12.8 |
| vulnerable_at: 1.12.7 |
| packages: |
| - package: net/http |
| symbols: |
| - http2serverConn.serve |
| - http2serverConn.writeFrame |
| - http2serverConn.scheduleFrameWrite |
| skip_fix: 'TODO: revisit this reason (fix appears to not work with Go <1.18)' |
| - module: golang.org/x/net |
| versions: |
| - fixed: 0.0.0-20190813141303-74dc4d7220e7 |
| vulnerable_at: 0.0.0-20190607181551-461777fb6f67 |
| packages: |
| - package: golang.org/x/net/http2 |
| symbols: |
| - serverConn.serve |
| - serverConn.writeFrame |
| - serverConn.scheduleFrameWrite |
| derived_symbols: |
| - Server.ServeConn |
| summary: Reset flood in net/http and golang.org/x/net/http |
| description: |- |
| Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading |
| to a denial of service. |
| |
| Servers that accept direct connections from untrusted clients could be remotely |
| made to allocate an unlimited amount of memory, until the program crashes. The |
| attacker opens a number of streams and sends an invalid request over each stream |
| that should solicit a stream of RST_STREAM frames from the peer. Depending on |
| how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, |
| or both. |
| published: 2022-08-01T22:20:53Z |
| cves: |
| - CVE-2019-9512 |
| - CVE-2019-9514 |
| ghsas: |
| - GHSA-39qc-96h7-956f |
| - GHSA-hgr8-6h9x-f7q9 |
| credits: |
| - Jonathan Looney of Netflix |
| references: |
| - fix: https://go.dev/cl/190137 |
| - fix: https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5 |
| - report: https://go.dev/issue/33606 |
| - web: https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ |
| review_status: REVIEWED |
