Описание
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.
Отчет
This vulnerability is rated with an Important severity for Red Hat products because an unauthenticated remote attacker can exhaust server compute resources over the network, leading to a complete service outage. Across Red Hat enterprise environments, Go is widely deployed in container runtimes, monitoring daemons, and OpenShift infrastructure components. However, exploitation is restricted to applications that actively listen on the network and serve content using standard library HTTP handlers that process multi-range requests. CLI utilities and server components that do not handle byte-range requests from untrusted clients remain unaffected.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | helm | Affected | ||
| OpenShift Pipelines | openshift-pipelines-client | Affected | ||
| OpenShift Serverless | kn-workflow-plugin | Affected | ||
| OpenShift Serverless | openshift-serverless-clients | Affected | ||
| OpenShift Service Mesh 3 | istio-proxy | Not affected | ||
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl32 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | receptor | Affected |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
When parsing a Range header containing a large number of small ranges, ...
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
7.5 High
CVSS3