CVE-2023-39326: Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
Other sources
Denial of service via chunk extensions in net/http
— Microsoft
Golang Go could allow a remote attacker to obtain sensitive information, caused by a flaw in the net/http package. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to read many more bytes from the network than are in the body, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.20.12 - Upgrade
Upgrade
redhat/golang 1.21.0to a version that resolves this vulnerability.Fixed in 0 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.21.5 - Configuration
Upgrade to a Go version where the net/http chunked encoding reader discards chunk extension metadata and produces an error when the ratio of real body to encoded bytes grows too small (mitigates DoS via chunk extensions).
Golang net/http chunked encoding reader Chunk extension metadata handling = Discard chunk extension metadata and enforce a failure when encoded-to-real body ratio grows too small
Event History
Frequently Asked Questions
What is the severity of CVE-2023-39326?
CVE-2023-39326 has been classified with a significant severity level due to its potential for denial of service through excessive data reading.
How do I fix CVE-2023-39326?
To mitigate CVE-2023-39326, upgrade to Go version 1.20.12 or later for Red Hat packages, or version 1.21.5 or later.
Which versions are affected by CVE-2023-39326?
CVE-2023-39326 affects Go versions up to 1.20.12 and versions before 1.21.0 for certain Red Hat packages.
What type of vulnerability is CVE-2023-39326?
CVE-2023-39326 is a denial of service vulnerability that can be exploited via malicious HTTP requests.
Can all Go versions be impacted by CVE-2023-39326?
No, only specific versions of Go, particularly those outlined in the affected software list, are impacted by CVE-2023-39326.