Описание
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.
Отчет
A flaw was found in the Go net/http package and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of HTTP/2 streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Each SETTINGS frame forces the server or client to iterate over all open streams to adjust their flow-control windows, resulting in quadratic CPU usage and denial of service. This vulnerability affects all Go programs that serve or consume HTTP/2 traffic using net/http or golang.org/x/net/http2.
Меры по смягчению последствий
In case you consume HTTP2, upgrade to a patched version of the http module. Verify:
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat/cryostat-grafana-dashboard-rhel9 | Affected | ||
| OpenShift Developer Tools and Services | helm | Affected | ||
| OpenShift Pipelines | openshift-pipelines-client | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-scheduler-rhel9 | Affected | ||
| OpenShift Serverless | kn-workflow-plugin | Affected | ||
| OpenShift Serverless | openshift-serverless-clients | Affected | ||
| OpenShift Service Mesh 3 | istio-proxy | Affected | ||
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-operator-bundle | Affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the cli ...
EPSS
7.5 High
CVSS3