CVE-2023-39325:
HTTP/2 rapid reset can cause excessive work in net/http
7.5
CVSS ScoreBasic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/net | go | < 0.17.0 | 0.17.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability occurs because the HTTP/2 server did not limit the number of concurrently executing handler goroutines when clients rapidly reset streams. The processHeaders function was responsible for initiating these handlers. Before the patch, it would call runHandler in a new goroutine for each request without adequate checks if prior requests were reset mid-flight. The runHandler function is where the resource-consuming work happens. The patch introduces scheduleHandler and handlerDone to implement a queue and limit for these goroutines, modifying processHeaders to use this new scheduling logic and runHandler to signal its completion. Therefore, processHeaders (in its pre-patch state) is the primary function that allows the vulnerability to be triggered, and runHandler is the function whose uncontrolled concurrent execution leads to resource exhaustion.