net/http/internal/http2 vulnerabilities
6 known vulnerabilities in net/http/internal/http2 from Go standard library. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
net/http: Concurrent Execution using Shared Resource with Improper Synchronization
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part o
- 7.5 High severity
net/http: Asymmetric Resource Consumption (Amplification)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
- 9.1 Critical severity
net/http: Multiple Operations on Resource in Single-Operation Context
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client
- 7.5 High severity
net/http: Inconsistent Interpretation of HTTP Requests
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers
- 7.5 High severity
net/http: Asymmetric Resource Consumption (Amplification)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a maliciou
- 8.2 High severity
net/http: Improper Validation of Unsafe Equivalence in Input
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e