Go x/net v0.60.0 fixes for HTTP/2 DoS via Trailer, CPU, and Double Stream Refund

Vulnerability Overview The v0.60.0 release includes fixes for the following security issues: 1. net/http: HTTP/2 Server Memory Exhaustion Due to Trailer Headers - When a client sends a "Trailer" header, the HTTP server internally uses these header values to populate the map. Since is a map, each entry increases memory overhead. HTTP/2 servers are vulnerable to this: a malicious client can exploit this by sending a "Trailer" header declaring a large number of fields, causing the server to allocate excessive memory and bypass the and limits. This vulnerability does not affect HTTP/1.x servers, as they do not support multiplexing and the calculation of and differs. - The and limits are now applied to trailer fields declared in the "Trailer" header. 2. net/http: CPU Exhaustion Due to Repeated Initial Window Size Changes - A malicious HTTP/2 peer can cause excessive CPU consumption on the client or server by opening numerous streams and sending small SETTINGS frames containing the value. - HTTP/2 clients and servers now handle window size changes more efficiently, capping the window size at (rather than allowing multiples of ). 3. net/http: Double Stream Control Refund on HTTP/2 Server Streams - An HTTP/2 server may refund flow control for the same data stream twice: once when the client requests the stream (refunding the portion of the stream not yet sent) and again when the request handler reads buffered data. A malicious client can exploit this to bypass configured flow control limits ( ). The total buffer size remains constrained by the concurrent stream limit and stream-level flow control. - HTTP/2 servers now wait for stream-level flow control refunds until the request handler has completed. Affected Scope net/http: HTTP/2 Server Memory Exhaustion Due to Trailer Headers - Affects HTTP/2 servers, particularly those that have not properly configured and limits. net/http: CPU Exhaustion Due to Repeated Initial Window Size Changes - Affects HTTP/2 clients and servers, particularly those that do not handle window size changes correctly. net/http: Double Stream Control Refund on HTTP/2 Server Streams - Affects HTTP/2 servers, particularly those that have not properly configured flow control limits. Remediation net/http: HTTP/2 Server Memory Exhaustion Due to Trailer Headers - Apply and limits to trailer fields declared in the "Trailer" header. net/http: CPU Exhaustion Due to Repeated Initial Window Size Changes - Handle window size changes more efficiently, capping the window size at . net/http: Double Stream Control Refund on HTTP/2 Server Streams - Wait for stream-level flow control refunds until the request handler has completed. POC Code or Exploit Code No specific POC code or exploit code was provided in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Go x/net v0.60.0 fixes for HTTP/2 DoS via Trailer, CPU, and Double Stream Refund

More from this source