REDHAT-BUG-2309710: Go golang.org/x/net/http2 vulnerability

Published Sep 4, 2024

Updated

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.

Affected Software

1 affected component

go golang.org/x/net/http2

Event History

Sep 4, 2024

Data Sourced

via Red Hat·02:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2309710?

The severity of REDHAT-BUG-2309710 is high due to the potential for excessive server resource consumption.

How do I fix REDHAT-BUG-2309710?

Fixing REDHAT-BUG-2309710 involves applying the latest security patches provided by Red Hat.

What systems are affected by REDHAT-BUG-2309710?

REDHAT-BUG-2309710 affects systems that utilize HTTP/2 and are configured with the http2.Server.MaxConcurrentStreams setting.

Can REDHAT-BUG-2309710 lead to a denial of service?

Yes, exploitation of REDHAT-BUG-2309710 can lead to denial of service due to resource exhaustion.

Is user authentication compromised by REDHAT-BUG-2309710?

No, REDHAT-BUG-2309710 does not compromise user authentication but affects server performance.