Homepage

Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package ose-thanos.src  (opens in a new tab)

Threat Intelligence

EPSS
66.64% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-OSETHANOSSRC-14922622
  • published14 Jan 2026
  • disclosed1 Jan 2023
Report a new vulnerability Found a mistake?

Introduced: 1 Jan 2023

CVE-2023-45288  (opens in a new tab)
CWE-400  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ose-thanos.src package and not the ose-thanos.src package as distributed by RHEL.

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.