CVE-2023-45288 HTTP/2 CONTINUATION flood in net/http
An attacker can cause denial of service in Go HTTP/2 endpoints by sending excessive CONTINUATION frames, forcing expensive header parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45288?
CVE-2023-45288 is a high-severity denial of service vulnerability in golang.org/x/net/http2, published on 4 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Which versions are affected by CVE-2023-45288?
11 open source packages ship an affected version, including golang.org/x/net/http2, golang and golang.org/x/net.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net/http2 Go | All versions | 0.23.0 |
golang.org/x/net/http2 Go | All versions | 0.23.0 |
golang Bitnami | All versions | 1.21.9, 1.22.2 |
golang.org/x/net Go | All versions | 0.23.0 |
golang.org/x/net Go | All versions | 0.23.0 |
golang.org/x/net Go | All versions | 0.23.0 |
5 more packages
net/http Go | All versions | 1.21.9 |
net/http Go | All versions | 1.21.9 |
net/http Go | From 1.22.0-0 | 1.22.2 |
net/http Go | From 1.22.0-0 | 1.22.2 |
stdlib Go | All versions | 1.21.9, 1.22.2 |
Linux distribution packages (29)
delve AlmaLinux:8 | All versions | 1.20.2-1.module_el8.9.0+3642+43318da8 |
git-lfs AlmaLinux:8 | All versions | 3.2.0-3.el8_9 |
go-toolset AlmaLinux:8 | All versions | 1.20.12-1.module_el8.9.0+3728+f1d47c6f |
golang AlmaLinux:8 | All versions | 1.20.12-8.module_el8.9.0+3818+ac9bcae6 |
golang-bin AlmaLinux:8 | All versions | 1.20.12-8.module_el8.9.0+3818+ac9bcae6 |
golang-docs AlmaLinux:8 | All versions | 1.20.12-8.module_el8.9.0+3818+ac9bcae6 |
golang-misc AlmaLinux:8 | All versions | 1.20.12-8.module_el8.9.0+3818+ac9bcae6 |
golang-src AlmaLinux:8 | All versions | 1.20.12-8.module_el8.9.0+3818+ac9bcae6 |
golang-tests AlmaLinux:8 | All versions | 1.20.12-8.module_el8.9.0+3818+ac9bcae6 |
git-lfs AlmaLinux:9 | All versions | 3.2.0-2.el9_3 |
go-toolset AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
golang AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
golang-bin AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
golang-docs AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
golang-misc AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
golang-src AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
golang-tests AlmaLinux:9 | All versions | 1.20.12-4.el9_3 |
go-toolset-1.19-golang Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
go-toolset-1.19-golang-bin Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
go-toolset-1.19-golang-docs Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
go-toolset-1.19-golang-misc Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
go-toolset-1.19-golang-race Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
go-toolset-1.19-golang-src Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
go-toolset-1.19-golang-tests Red Hat:devtools:2023::el7 | All versions | 0:1.19.13-7.el7_9 |
rhc-worker-script Red Hat:enterprise_linux:7::client | All versions | 0:0.8-1.el7_9 |
rhc-worker-script Red Hat:enterprise_linux:7::server | All versions | 0:0.8-1.el7_9 |
rhc-worker-script Red Hat:enterprise_linux:7::workstation | All versions | 0:0.8-1.el7_9 |
delve Red Hat:enterprise_linux:8::appstream | All versions | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
delve-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
How do I fix CVE-2023-45288?
Upgrade golang.org/x/net/http2 to 0.23.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-45288 being exploited?
There is no known exploitation of CVE-2023-45288 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2024:1962, ALSA-2024:1963, ALSA-2024:2079, ALSA-2024:2699, AZL-38158, AZL-38173 and 144 more.