Allocation of Resources Without Limits or Throttling Affecting golang.org/x/net/http2 package, versions <0.17.0
Threat Intelligence
EPSS
0.42% (75th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOLANGORGXNETHTTP2-5958903
- published 27 Nov 2023
- disclosed 10 Oct 2023
- credit Damien Neil
Introduced: 10 Oct 2023
CVE-2023-39325 Open this link in a new tabHow to fix?
Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.
Overview
golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when MaxConcurrentStreams handler goroutines running, by rapidly creating requests and
immediately resetting them. A a handler is started until one of the existing handlers exits.
Note:
This issue is related to CVE-2023-44487