Описание
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-1.27 | fixed | 1.27.2-1 | package | |
| golang-1.26 | fixed | 1.26.9-1 | package | |
| golang-1.25 | removed | package | ||
| golang-1.24 | removed | package | ||
| golang-1.24 | no-dsa | trixie | package | |
| golang-1.19 | removed | package | ||
| golang-1.19 | postponed | bookworm | package | |
| golang-golang-x-net | fixed | 1:0.60.0-1 | package | |
| golang-golang-x-net | no-dsa | trixie | package | |
| golang-golang-x-net | postponed | bookworm | package |
Примечания
https://www.openwall.com/lists/oss-security/2026/10/08/9
https://github.com/golang/go/issues/81742
Fixed by: https://github.com/golang/go/commit/1d58cdaa1069e259b60c324ec77472f09f23d92e (go1.27.2)
Fixed by: https://github.com/golang/go/commit/6e049521882c944afc1e519a83971ec421dc2974 (go1.26.9)
Fixed by: https://github.com/golang/net/commit/cc7d34fd2dd5864bcafe3e5e0a84919240be98c0 (v0.60.0)
Связанные уязвимости
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Excessive CPU consumption from repeated initial window changes in net/http
