CVE-2024-8421: Golang.org/x/net/http2: multiple http/2 enabled web servers (rapid reset attack)
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.
Other sources
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8421?
CVE-2024-8421 has a severity rating that indicates it can cause excessive resource consumption on servers.
How do I fix CVE-2024-8421?
To mitigate CVE-2024-8421, adjust the http2.Server.MaxConcurrentStreams setting to limit the number of concurrent requests.
What systems are affected by CVE-2024-8421?
CVE-2024-8421 affects systems that utilize the HTTP/2 protocol with insufficient request handling.
What are the attacks associated with CVE-2024-8421?
CVE-2024-8421 can be exploited by a malicious client that rapidly sends and resets HTTP/2 requests.
What are the potential impacts of CVE-2024-8421?
The potential impacts of CVE-2024-8421 include degraded server performance due to excessive resource consumption.