{"answers":{"affected":"4 open source packages ship an affected version, including github.com/spiffe/spire.","exploited":"There is no known exploitation of GHSA-m7vp-hqwv-7m5x in the wild and no public exploit code.","fix":"Upgrade github.com/spiffe/spire to a fixed version for your release line: 1.0.3 or 1.1.3.","what":"GHSA-m7vp-hqwv-7m5x is a denial of service vulnerability in github.com/spiffe/spire, published on 12 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-m7vp-hqwv-7m5x and fix it if it is affected.\n\nWhat it is: GHSA-m7vp-hqwv-7m5x is a denial of service vulnerability in github.com/spiffe/spire, published on 12 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-m7vp-hqwv-7m5x in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/spiffe/spire (Go): affected all versions; fixed in 1.0.3\n- github.com/spiffe/spire (Go): affected all versions; fixed in 1.0.3\n- github.com/spiffe/spire (Go): affected from 1.1.0; fixed in 1.1.3\n- github.com/spiffe/spire (Go): affected from 1.1.0; fixed in 1.1.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-m7vp-hqwv-7m5x/ (Markdown: https://insights.sbomify.com/GHSA-m7vp-hqwv-7m5x/index.md)","id":"GHSA-m7vp-hqwv-7m5x","markdown":"https://insights.sbomify.com/GHSA-m7vp-hqwv-7m5x/index.md","name":"GHSA-m7vp-hqwv-7m5x","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"SPIRE identity server","requires_auth":"none","summary":"Attackers can cause denial of service via unbounded memory usage in SPIRE HTTP/2 endpoints using the vulnerable Go net/http package.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nThe net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/http package. HTTP/2 endpoints consuming the net/http package within SPIRE server and agent (or other components in this repository) that are _on by default_ include the following:\n- OIDC Discovery Provider\n- K8s Workload Registrar in webhook mode\n\nThe following endpoints are vulnerable _when enabled_:\n- SPIRE server bundle endpoint (i.e. Federation API)\n\nThe following endpoints are _NOT_ vulnerable, since HTTP/2 support in go is not enabled on non-TLS protected endpoints:\n- SPIRE server/agent metrics endpoint when configured for Prometheus\n- SPIRE server/agent health endpoints\n- SPIRE server/agent profiling endpoints\n\n### Patches\nSPIRE 1.0.3 and 1.1.3 have been released with an upgraded Go toolchain which patches the vulnerability\n\n### Workarounds\nThe vulnerability can be worked around entirely by including the `http2server=0` value in the `GODEBUG` environment variable (see https://github.com/golang/go/issues/50058). This turns off HTTP/2 support on all non-gRPC endpoints. They will still function with HTTP/1.1.\n\nThe risk associated with this vulnerability can be somewhat mitigated by limiting the exposure of the endpoints in question. If necessary, vulnerable components or endpoints that are optionally configured can be disabled temporarily.\n\n### References\n- https://github.com/golang/go/issues/50058\n- https://go-review.googlesource.com/c/go/+/370574/\n- https://nvd.nist.gov/vuln/detail/CVE-2021-44716","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints","id":"GHSA-m7vp-hqwv-7m5x","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.0.3"],"introduced":["0"],"last_affected":[],"package":"github.com/spiffe/spire","purl":null,"source":"GHSA-m7vp-hqwv-7m5x"},{"ecosystem":"Go","fixed":["1.0.3"],"introduced":["0"],"last_affected":[],"package":"github.com/spiffe/spire","purl":"pkg:golang/github.com/spiffe/spire","source":"GHSA-m7vp-hqwv-7m5x"},{"ecosystem":"Go","fixed":["1.1.3"],"introduced":["1.1.0"],"last_affected":[],"package":"github.com/spiffe/spire","purl":null,"source":"GHSA-m7vp-hqwv-7m5x"},{"ecosystem":"Go","fixed":["1.1.3"],"introduced":["1.1.0"],"last_affected":[],"package":"github.com/spiffe/spire","purl":"pkg:golang/github.com/spiffe/spire","source":"GHSA-m7vp-hqwv-7m5x"}],"products":null,"published":"2022-01-12","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can cause denial of service via unbounded memory usage in SPIRE HTTP/2 endpoints using the vulnerable Go net/http package.","url":"https://insights.sbomify.com/GHSA-m7vp-hqwv-7m5x/"}