{"id":"CVE-2023-45288","published":"2024-04-04T20:37:30Z","modified":"2025-11-04T18:17:43Z","title":"HTTP/2 CONTINUATION flood in net/http","vendor":"Go standard library","product":"net/http","tier":"core","eol":null,"affectedVersions":[{"vendor":"Go standard library","product":"net/http","versions":["< 1.21.9",">= 1.22.0-0, < 1.22.2"]},{"vendor":"golang.org/x/net","product":"golang.org/x/net/http2","versions":["< 0.23.0"]}],"description":{"text":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.","provenance":"source","from":"CVE.org"},"summary":{"text":"The net/http package in the Go standard library has an HTTP/2 flaw in which header frames beyond the MaxHeaderBytes limit are still parsed and decoded, even though their memory is not retained. An unauthenticated remote attacker who can reach an HTTP/2 endpoint with no user interaction can send an excessive number of CONTINUATION frames, consuming server processing resources (and potentially making the server unresponsive) before the request is rejected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:42Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.91969,"percentile":0.99819,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"openSUSE Patches Four Bundled Go Library Flaws in Prometheus Blackbox Exporter","url":"https://otx.alienvault.com/pulse/6ac7c4b1eeef2ce95503f4a2","created":"2026-10-08"},{"name":"ACTUALIZACION | IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java, Node.js and IBM WebSphere Application Server Liberty","url":"https://otx.alienvault.com/pulse/672f88f9190a6de9940c4e58","created":"2024-11-09"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://go.dev/issue/65051","tags":[]},{"url":"https://go.dev/cl/576155","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2024-2687","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0009/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/05/4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/03/16","tags":[]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"net/http","vulnerableRanges":["<1.21.9",">=1.22.0-0, <1.22.2"],"patched":["1.21.9","1.22.2"],"from":["GHSA-4v7x-pqxf-cx7m"],"provenance":"source"},{"ecosystem":"Go","package":"golang.org/x/net/http2","vulnerableRanges":["<0.23.0"],"patched":["0.23.0"],"from":["GHSA-4v7x-pqxf-cx7m"],"provenance":"source"},{"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.23.0"],"patched":["0.23.0"],"from":["GHSA-4v7x-pqxf-cx7m","GO-2024-2687"],"provenance":"source"},{"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.21.9",">=1.22.0-0, <1.22.2"],"patched":["1.21.9","1.22.2"],"from":["GO-2024-2687"],"provenance":"source"}],"advisories":[{"id":"GHSA-4v7x-pqxf-cx7m","url":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","severity":"MODERATE","ecosystem":"Go","package":"net/http","vulnerableRanges":["<1.21.9"],"patched":["1.21.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4v7x-pqxf-cx7m","url":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","severity":"MODERATE","ecosystem":"Go","package":"golang.org/x/net/http2","vulnerableRanges":["<0.23.0"],"patched":["0.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4v7x-pqxf-cx7m","url":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","severity":"MODERATE","ecosystem":"Go","package":"net/http","vulnerableRanges":[">=1.22.0-0, <1.22.2"],"patched":["1.22.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4v7x-pqxf-cx7m","url":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","severity":"MODERATE","ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.23.0"],"patched":["0.23.0"],"provenance":"source","from":"GHSA"},{"id":"GO-2024-2687","url":"https://osv.dev/vulnerability/GO-2024-2687","severity":null,"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.21.9",">=1.22.0-0, <1.22.2"],"patched":["1.21.9","1.22.2"],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2024-1094","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1094","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-04-12","earliestUrl":"https://github.com/hex0punk/cont-flood-poc","repos":[{"name":"hex0punk/cont-flood-poc","url":"https://github.com/hex0punk/cont-flood-poc","stars":5,"created":"2024-04-12"}]},"first":{"date":"2024-04-12","source":"PoC-in-GitHub","url":"https://github.com/hex0punk/cont-flood-poc"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-04-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-45288","provenance":"source"},{"date":"2024-04-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hex0punk/cont-flood-poc","provenance":"source"}],"speed":{"daysToPublicExploit":8,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-24783","published":"2024-03-05","fixed":"1.22.1","kev":false},{"cve":"CVE-2024-24784","published":"2024-03-05","fixed":"1.22.1","kev":false},{"cve":"CVE-2024-24785","published":"2024-03-05","fixed":"1.22.1","kev":false},{"cve":"CVE-2023-45288","published":"2024-04-04","fixed":"1.22.2","kev":false},{"cve":"CVE-2024-24788","published":"2024-05-08","fixed":"1.22.3","kev":false,"link":{"from":"CVE-2023-45288","to":"CVE-2024-24788","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:stdlib","fromFixed":"1.22.2","toFixed":"1.22.3","daysApart":34}]}},{"cve":"CVE-2024-24789","published":"2024-06-05","fixed":"1.22.4","kev":false,"link":{"from":"CVE-2023-45288","to":"CVE-2024-24789","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:stdlib","fromFixed":"1.21.9","toFixed":"1.21.11","daysApart":62}]}},{"cve":"CVE-2024-24790","published":"2024-06-05","fixed":"1.22.4","kev":false,"link":{"from":"CVE-2023-45288","to":"CVE-2024-24790","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:stdlib","fromFixed":"1.21.9","toFixed":"1.21.11","daysApart":62}]}}],"package":"Go:stdlib"}}