CVE-2023-39325

Summary

CVE-2023-39325 is a vulnerability affecting HTTP/2 servers where a malicious client can cause excessive resource consumption by rapidly creating and resetting requests. This allows the attacker to bypass the server's MaxConcurrentStreams limit and create new requests while existing ones are still being processed. The fix for this issue involves limiting the number of simultaneously executing handler goroutines to the stream concurrency limit, causing new requests to be queued when at the limit. If the request queue grows too large, the server will terminate the connection. This issue is also addressed in the golang.org/x/net/http2 package, with a default stream concurrency limit of 250 streams (requests) per HTTP/2 connection, which can be adjusted as needed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.