CVE-2023-39325
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-39325 is a vulnerability affecting HTTP/2 servers where a malicious client can cause excessive resource consumption by rapidly creating and resetting requests. This allows the attacker to bypass the server's MaxConcurrentStreams limit and create new requests while existing ones are still being processed. The fix for this issue involves limiting the number of simultaneously executing handler goroutines to the stream concurrency limit, causing new requests to be queued when at the limit. If the request queue grows too large, the server will terminate the connection. This issue is also addressed in the golang.org/x/net/http2 package, with a default stream concurrency limit of 250 streams (requests) per HTTP/2 connection, which can be adjusted as needed.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Golang Go
- Fedora Operating System
Affected Vendors
- Fedora Project
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions