Loading vulnerability…
HTTP/2 Rapid Reset denial of service in Go
CVE-2023-39325 is a resource-exhaustion vulnerability in Go's net/http and golang.org/x/net/http2 server implementations. A malicious HTTP/2 client can rapidly create requests and immediately reset their streams while the associated request-handler goroutines continue executing. Resetting a stream permits another request to be accepted, allowing concurrently executing handlers to exceed the intended Server.MaxConcurrentStreams bound and consume excessive server resources. The vulnerability affects the standard library before Go 1.20.10 and Go 1.21.3 in their respective release branches, and golang.org/x/net/http2 before v0.17.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Rapid creation and cancellation of HTTP/2 requests can exhaust server resources, degrade performance, and cause denial of service by preventing affected services from processing legitimate requests. The stream-concurrency limit does not effectively bound executing request handlers in vulnerable implementations.
If you can’t patch tonight, do this now.
Temporarily disable HTTP/2 endpoints where operationally feasible until patches are deployed. Restrict affected endpoints to trusted clients where possible and apply IP-based blocking, flood protection, and network-layer rate controls. Connection limits alone may not prevent the attack because many streams can be created and reset within one connection.
Patch, then assume compromise.
Upgrade affected Go 1.20 deployments to Go 1.20.10 or later and Go 1.21 deployments to Go 1.21.3 or later, or use a newer supported patched release. Upgrade golang.org/x/net/http2 to v0.17.0 or later where used directly. The fix caps simultaneously executing handler goroutines at Server.MaxConcurrentStreams, queues excess requests, and terminates connections when the queue becomes too large. For affected Traefik deployments, upgrade version 2 installations to 2.10.5 or later and version 3 beta installations to 3.0.0-beta4 or later. Apply vendor security updates to products bundling affected Go components and rebuild affected containers after patched base images become available.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
148 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.