HTTP/2 server memory exhaustion due to Trailer headers in net/http

Double flow control refund on HTTP/2 server streams in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk/m/cs6qIK5BAAJ announces the release of Go versions 1.24.2 and 1.23.8, including a security fix for: net/http: request smuggling through invalid chunked data

The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling.

The net/http package now rejects chunk-size lines containing a bare LF.

Thanks to Jeppe Bonde Weikop for reporting this issue.

This is CVE-2025-22871 and Go issue https://go.dev/issue/71988. -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Security Fix(es): golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.