id: GO-2023-2382
modules:
    - module: std
      versions:
        - fixed: 1.20.12
        - introduced: 1.21.0-0
        - fixed: 1.21.5
      vulnerable_at: 1.21.4
      packages:
        - package: net/http/internal
          symbols:
            - chunkedReader.beginChunk
            - readChunkLine
          derived_symbols:
            - chunkedReader.Read
summary: Denial of service via chunk extensions in net/http
description: |-
    A malicious HTTP sender can use chunk extensions to cause a receiver reading
    from a request or response body to read many more bytes from the network than
    are in the body.

    A malicious HTTP client can further exploit this to cause a server to
    automatically read a large amount of data (up to about 1GiB) when a handler
    fails to read the entire body of a request.

    Chunk extensions are a little-used HTTP feature which permit including
    additional metadata in a request or response body sent using the chunked
    encoding. The net/http chunked encoding reader discards this metadata. A sender
    can exploit this by inserting a large metadata segment with each byte
    transferred. The chunk reader now produces an error if the ratio of real body to
    encoded bytes grows too small.
credits:
    - Bartek Nowotarski
references:
    - report: https://go.dev/issue/64433
    - fix: https://go.dev/cl/547335
    - web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
cve_metadata:
    id: CVE-2023-39326
    cwe: 'CWE-400: Uncontrolled Resource Consumption'
    references:
        - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
review_status: REVIEWED