An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
{ "binaries": [ { "binary_version": "1.18.1-1ubuntu1~20.04.3", "binary_name": "golang-1.18" }, { "binary_version": "1.18.1-1ubuntu1~20.04.3", "binary_name": "golang-1.18-go" }, { "binary_version": "1.18.1-1ubuntu1~20.04.3", "binary_name": "golang-1.18-src" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1.21.1-1~ubuntu20.04.3", "binary_name": "golang-1.21" }, { "binary_version": "1.21.1-1~ubuntu20.04.3", "binary_name": "golang-1.21-go" }, { "binary_version": "1.21.1-1~ubuntu20.04.3", "binary_name": "golang-1.21-src" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1.17.13-3ubuntu1.3", "binary_name": "golang-1.17" }, { "binary_version": "1.17.13-3ubuntu1.3", "binary_name": "golang-1.17-go" }, { "binary_version": "1.17.13-3ubuntu1.3", "binary_name": "golang-1.17-src" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1.18.1-1ubuntu1.2", "binary_name": "golang-1.18" }, { "binary_version": "1.18.1-1ubuntu1.2", "binary_name": "golang-1.18-go" }, { "binary_version": "1.18.1-1ubuntu1.2", "binary_name": "golang-1.18-src" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1.21.1-1~ubuntu22.04.3", "binary_name": "golang-1.21" }, { "binary_version": "1.21.1-1~ubuntu22.04.3", "binary_name": "golang-1.21-go" }, { "binary_version": "1.21.1-1~ubuntu22.04.3", "binary_name": "golang-1.21-src" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1", "binary_name": "golang-1.18" }, { "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1", "binary_name": "golang-1.18-go" }, { "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1", "binary_name": "golang-1.18-src" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }
{ "binaries": [ { "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1", "binary_name": "golang-1.18" }, { "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1", "binary_name": "golang-1.18-go" }, { "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1", "binary_name": "golang-1.18-src" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }
{ "binaries": [ { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8-go" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8-go-shared-dev" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8-src" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "libgolang-1.8-std1" } ] }