Loading vulnerability…
HTTP chunk-extension resource-exhaustion denial of service in Go
CVE-2023-39326 is an uncontrolled resource-consumption vulnerability in Go's net/http chunked-encoding reader, implemented in net/http/internal. The reader discards HTTP chunk-extension metadata without adequately limiting its size relative to the decoded body. A malicious HTTP sender can attach large metadata segments to small chunks, causing a receiver processing a request or response body to read substantially more network data than the body contains. A malicious client can additionally cause a server to automatically read up to approximately 1 GiB when a request handler does not consume the entire request body. Excessive reading can lead to denial of service. The fix makes the chunk reader return an error when the proportion of actual body data to encoded bytes becomes too small.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Affected HTTP clients and servers can be forced to consume excessive network data while processing chunked bodies. Server-side automatic reading can reach approximately 1 GiB when a handler leaves part of the request body unread. This resource consumption can cause response-reading failures and potentially deny service.
If you can’t patch tonight, do this now.
Red Hat states that no mitigation is available for CVE-2023-39326. Deploy the applicable fixes rather than relying on an unverified workaround.
Patch, then assume compromise.
Update Go and affected Go-based applications to vendor releases incorporating the chunk-reader fix, which rejects excessively low ratios of body data to encoded bytes. Apply applicable distribution package updates and replace affected container images; rebuild dependent container images where required. Specific fixed RHEL 9 packages include Buildah 1.33.6-2.el9 under RHSA-2024:2245, Podman 4.9.4-0.1.el9 under RHSA-2024:2193, and containernetworking-plugins 1.4.0-2.el9_4 under RHSA-2024:2272.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.