Description
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Published: 2024-04-04
Score: 7.5 High
EPSS: 71.5% High
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4v7x-pqxf-cx7m net/http, x/net/http2: close connections when receiving too many headers
Ubuntu USN Ubuntu USN USN-6886-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.64852}

epss

{'score': 0.75268}


Tue, 17 Jun 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat stf
CPEs cpe:/a:redhat:service_telemetry_framework:1.5::el8 cpe:/a:redhat:stf:1.5::el8
Vendors & Products Redhat service Telemetry Framework
Redhat stf

Thu, 29 May 2025 02:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_gitops:1.14::el8

Fri, 16 May 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Gitops
CPEs cpe:/a:redhat:openshift_gitops:1.15::el8
Vendors & Products Redhat openshift Gitops

Mon, 28 Apr 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:6.1::el9
Vendors & Products Redhat ceph Storage

Wed, 26 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Pipelines
CPEs cpe:/a:redhat:openshift_pipelines:1.15::el8
Vendors & Products Redhat openshift Pipelines

Thu, 13 Feb 2025 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net\/http
Golang
Golang http2
CPEs cpe:2.3:a:go_standard_library:net\/http:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:http2:*:*:*:*:*:*:*:*
Vendors & Products Go Standard Library
Go Standard Library net\/http
Golang
Golang http2
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 13 Feb 2025 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat cert Manager
CPEs cpe:/a:redhat:cert_manager:1.15::el9
Vendors & Products Redhat cert Manager

Wed, 09 Oct 2024 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:service_interconnect:1.4::el8
cpe:/a:redhat:service_interconnect:1.4::el9

Thu, 26 Sep 2024 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt

Fri, 06 Sep 2024 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Builds
CPEs cpe:/a:redhat:openshift:4.16::el9
cpe:/a:redhat:openshift_builds:1.1::el9
Vendors & Products Redhat openshift Builds

Subscriptions

Go Standard Library Net\/http
Golang Http2
Redhat Acm Advanced Cluster Security Ansible Automation Platform Ceph Storage Cert Manager Container Native Virtualization Cryostat Devtools Enterprise Linux Logging Migration Toolkit Applications Openshift Openshift Api Data Protection Openshift Builds Openshift Custom Metrics Autoscaler Openshift Devspaces Openshift Distributed Tracing Openshift Gitops Openshift Pipelines Openshift Secondary Scheduler Openstack Rhel Aus Rhel E4s Rhel Eus Rhel Tus Rhmt Run Once Duration Override Operator Serverless Service Interconnect Service Mesh Stf
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-11-04T18:17:43.583Z

Reserved: 2023-10-06T17:06:26.221Z

Link: CVE-2023-45288

cve-icon Vulnrichment

Updated: 2025-11-04T18:17:43.583Z

cve-icon NVD

Status : Deferred

Published: 2024-04-04T21:15:16.113

Modified: 2026-04-15T00:35:42.020

Link: CVE-2023-45288

cve-icon Redhat

Severity : Important

Publid Date: 2024-04-03T00:00:00Z

Links: CVE-2023-45288 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses