Vulnerabilidades de golang http2 (CVE)

Registros CVE publicados para golang http2, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

3 resultados

7.5Alta

CVE-2026-33814 hace 6 meses

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

golang.org/x/net golang.org/x/net/http2; Go standard library net/http; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

7.5Alta

CVE-2023-45288 hace 2 años

HTTP/2 CONTINUATION flood in net/http

Go standard library net/http; golang.org/x/net golang.org/x/net/http2; go_standard_library net\/http; golang http2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

89%EPSS

7.5Alta

CVE-2023-44487 KEV hace 3 años

HTTP/2 Rapid Reset Attack Vulnerability

ietf http; Siemens RUGGEDCOM APE1808; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

100%EPSS