FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-05-08 09:03:38 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
cdb5e0e3-fafc-11ee-9c21-901b0e9408dc	go -- http2: close connections when receiving too many headers The Go project reports: http2: close connections when receiving too many headers Maintaining HPACK state requires that we parse and process all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, we don't allocate memory to store the excess headers but we do parse them. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. Discovery 2024-04-03 Entry 2024-04-15 go122 < 1.22.2 go121 < 1.21.9 CVE-2023-45288 https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M/m/khALNYGdAAAJ

VuXML ID

Description

cdb5e0e3-fafc-11ee-9c21-901b0e9408dc

go -- http2: close connections when receiving too many headers

The Go project reports:

http2: close connections when receiving too many headers

Maintaining HPACK state requires that we parse and process all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, we don't allocate memory to store the excess headers but we do parse them. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

Discovery 2024-04-03
Entry 2024-04-15
go122

< 1.22.2

go121

< 1.21.9

CVE-2023-45288
https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M/m/khALNYGdAAAJ