title: Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
description: A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
problem types: CWE 400: Uncontrolled Resource Consumption
affected:
{
vendor: Go standard library
product: net/http
collectionURL: https://pkg.go.dev
packageName: net/http
versions:
version: 0, lessThan: 1.19.6, status: affected, versionType: semver
version: 1.20.0-0, lessThan: 1.20.1, status: affected, versionType: semver
programRoutines:
name: Transport.RoundTrip
name: Server.Serve
name: Client.Do
name: Client.Get
name: Client.Head
name: Client.Post
name: Client.PostForm
name: Get
name: Head
name: ListenAndServe
name: ListenAndServeTLS
name: Post
name: PostForm
name: Serve
name: ServeTLS
name: Server.ListenAndServe
name: Server.ListenAndServeTLS
name: Server.ServeTLS
defaultStatus: unaffected
}
{
vendor: golang.org/x/net
product: golang.org/x/net/http2
collectionURL: https://pkg.go.dev
packageName: golang.org/x/net/http2
versions:
version: 0, lessThan: 0.7.0, status: affected, versionType: semver
programRoutines:
name: Transport.RoundTrip
name: Server.ServeConn
name: ClientConn.Close
name: ClientConn.Ping
name: ClientConn.RoundTrip
name: ClientConn.Shutdown
name: ConfigureServer
name: ConfigureTransport
name: ConfigureTransports
name: ConnectionError.Error
name: ErrCode.String
name: FrameHeader.String
name: FrameType.String
name: FrameWriteRequest.String
name: Framer.ReadFrame
name: Framer.WriteContinuation
name: Framer.WriteData
name: Framer.WriteDataPadded
name: Framer.WriteGoAway
name: Framer.WriteHeaders
name: Framer.WritePing
name: Framer.WritePriority
name: Framer.WritePushPromise
name: Framer.WriteRSTStream
name: Framer.WriteRawFrame
name: Framer.WriteSettings
name: Framer.WriteSettingsAck
name: Framer.WriteWindowUpdate
name: GoAwayError.Error
name: ReadFrameHeader
name: Setting.String
name: SettingID.String
name: SettingsFrame.ForeachSetting
name: StreamError.Error
name: Transport.CloseIdleConnections
name: Transport.NewClientConn
name: Transport.RoundTripOpt
name: bufferedWriter.Flush
name: bufferedWriter.Write
name: chunkWriter.Write
name: clientConnPool.GetClientConn
name: connError.Error
name: dataBuffer.Read
name: duplicatePseudoHeaderError.Error
name: gzipReader.Close
name: gzipReader.Read
name: headerFieldNameError.Error
name: headerFieldValueError.Error
name: noDialClientConnPool.GetClientConn
name: noDialH2RoundTripper.RoundTrip
name: pipe.Read
name: priorityWriteScheduler.CloseStream
name: priorityWriteScheduler.OpenStream
name: pseudoHeaderError.Error
name: requestBody.Close
name: requestBody.Read
name: responseWriter.Flush
name: responseWriter.FlushError
name: responseWriter.Push
name: responseWriter.SetReadDeadline
name: responseWriter.SetWriteDeadline
name: responseWriter.Write
name: responseWriter.WriteHeader
name: responseWriter.WriteString
name: serverConn.CloseConn
name: serverConn.Flush
name: stickyErrWriter.Write
name: transportResponseBody.Close
name: transportResponseBody.Read
name: writeData.String
defaultStatus: unaffected
}
{
vendor: golang.org/x/net
product: golang.org/x/net/http2/hpack
collectionURL: https://pkg.go.dev
packageName: golang.org/x/net/http2/hpack
versions:
version: 0, lessThan: 0.7.0, status: affected, versionType: semver
programRoutines:
name: Decoder.parseFieldLiteral
name: Decoder.readString
name: Decoder.DecodeFull
name: Decoder.Write
defaultStatus: unaffected
}
