5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-39326

CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or...

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-39326

CVE-2023-39326:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2023-39326) description states that the net/http chunked encoding reader discards chunk extension metadata but could be exploited by a sender inserting large metadata segments, causing the receiver to read many more bytes than are in the actual body. The Go security advisory (GO-2023-2382) explicitly lists net/http/internal.chunkedReader.Read, net/http/internal.chunkedReader.beginChunk, and net/http/internal.readChunkLine as the affected symbols. The fix, as seen in the commit message for f9913310015334850e951ed7653044971365492f and the code changes in src/net/http/internal/chunked.go, involves adding a mechanism to track the ratio of real body data to total encoded bytes (including extensions) and erroring if this ratio becomes too small (i.e., too much overhead). The functions chunkedReader.Read and chunkedReader.beginChunk are central to parsing chunked data, with readChunkLine being a helper. These functions, in their pre-patch state, lacked this protective check, making them vulnerable. The get_commit_infos tool failed to retrieve the diff, so patch evidence is based on the description of the fix and the code structure seen in get_file_content (which shows the patched state).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.