{"schema_version":"1.3.1","id":"GO-2022-0536","modified":"2024-05-20T16:03:47Z","published":"2022-08-01T22:20:53Z","aliases":["CVE-2019-9512","CVE-2019-9514","GHSA-39qc-96h7-956f","GHSA-hgr8-6h9x-f7q9"],"summary":"Reset flood in net/http and golang.org/x/net/http","details":"Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.\n\nServers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.","affected":[{"package":{"name":"stdlib","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.13"},{"introduced":"1.12.0-0"},{"fixed":"1.12.8"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["http2serverConn.scheduleFrameWrite","http2serverConn.serve","http2serverConn.writeFrame"]}]}},{"package":{"name":"golang.org/x/net","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20190813141303-74dc4d7220e7"}]}],"ecosystem_specific":{"imports":[{"path":"golang.org/x/net/http2","symbols":["Server.ServeConn","serverConn.scheduleFrameWrite","serverConn.serve","serverConn.writeFrame"]}]}}],"references":[{"type":"FIX","url":"https://go.dev/cl/190137"},{"type":"FIX","url":"https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5"},{"type":"REPORT","url":"https://go.dev/issue/33606"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ"}],"credits":[{"name":"Jonathan Looney of Netflix"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2022-0536","review_status":"REVIEWED"}}