medium
4
Advisory Published
Updated

REDHAT-BUG-2295310

First published: Tue Jul 02 2024(Updated: )

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

Affected SoftwareAffected VersionHow to fix
google net/http
google httputil.ReverseProxy

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of REDHAT-BUG-2295310?

    The severity of REDHAT-BUG-2295310 is categorized as medium due to the impact it has on client connection stability.

  • How do I fix REDHAT-BUG-2295310?

    To fix REDHAT-BUG-2295310, update the net/http client to the latest version where the issue has been addressed.

  • What are the potential impacts of REDHAT-BUG-2295310?

    The potential impacts of REDHAT-BUG-2295310 include failed requests and connections remaining in an invalid state.

  • Which software is affected by REDHAT-BUG-2295310?

    REDHAT-BUG-2295310 affects Google net/http and Google httputil.ReverseProxy.

  • Is REDHAT-BUG-2295310 a client-side or server-side issue?

    REDHAT-BUG-2295310 is primarily a client-side issue affecting how the HTTP/1.1 client handles server responses.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203