An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "golang-1.18", "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1" }, { "binary_name": "golang-1.18-doc", "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1" }, { "binary_name": "golang-1.18-go", "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1" }, { "binary_name": "golang-1.18-go-dbgsym", "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1" }, { "binary_name": "golang-1.18-src", "binary_version": "1.18.1-1ubuntu1~16.04.6+esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "golang-1.18", "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1" }, { "binary_name": "golang-1.18-doc", "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1" }, { "binary_name": "golang-1.18-go", "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1" }, { "binary_name": "golang-1.18-src", "binary_version": "1.18.1-1ubuntu1~18.04.4+esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.18", "binary_version": "1.18.1-1ubuntu1~20.04.3" }, { "binary_name": "golang-1.18-doc", "binary_version": "1.18.1-1ubuntu1~20.04.3" }, { "binary_name": "golang-1.18-go", "binary_version": "1.18.1-1ubuntu1~20.04.3" }, { "binary_name": "golang-1.18-go-dbgsym", "binary_version": "1.18.1-1ubuntu1~20.04.3" }, { "binary_name": "golang-1.18-src", "binary_version": "1.18.1-1ubuntu1~20.04.3" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.21", "binary_version": "1.21.1-1~ubuntu20.04.3" }, { "binary_name": "golang-1.21-doc", "binary_version": "1.21.1-1~ubuntu20.04.3" }, { "binary_name": "golang-1.21-go", "binary_version": "1.21.1-1~ubuntu20.04.3" }, { "binary_name": "golang-1.21-src", "binary_version": "1.21.1-1~ubuntu20.04.3" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.17", "binary_version": "1.17.13-3ubuntu1.3" }, { "binary_name": "golang-1.17-doc", "binary_version": "1.17.13-3ubuntu1.3" }, { "binary_name": "golang-1.17-go", "binary_version": "1.17.13-3ubuntu1.3" }, { "binary_name": "golang-1.17-go-dbgsym", "binary_version": "1.17.13-3ubuntu1.3" }, { "binary_name": "golang-1.17-src", "binary_version": "1.17.13-3ubuntu1.3" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.18", "binary_version": "1.18.1-1ubuntu1.2" }, { "binary_name": "golang-1.18-doc", "binary_version": "1.18.1-1ubuntu1.2" }, { "binary_name": "golang-1.18-go", "binary_version": "1.18.1-1ubuntu1.2" }, { "binary_name": "golang-1.18-go-dbgsym", "binary_version": "1.18.1-1ubuntu1.2" }, { "binary_name": "golang-1.18-src", "binary_version": "1.18.1-1ubuntu1.2" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.21", "binary_version": "1.21.1-1~ubuntu22.04.3" }, { "binary_name": "golang-1.21-doc", "binary_version": "1.21.1-1~ubuntu22.04.3" }, { "binary_name": "golang-1.21-go", "binary_version": "1.21.1-1~ubuntu22.04.3" }, { "binary_name": "golang-1.21-src", "binary_version": "1.21.1-1~ubuntu22.04.3" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.22", "binary_version": "1.22.2-2~22.04" }, { "binary_name": "golang-1.22-doc", "binary_version": "1.22.2-2~22.04" }, { "binary_name": "golang-1.22-go", "binary_version": "1.22.2-2~22.04" }, { "binary_name": "golang-1.22-src", "binary_version": "1.22.2-2~22.04" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.22", "binary_version": "1.22.4-1" }, { "binary_name": "golang-1.22-doc", "binary_version": "1.22.4-1" }, { "binary_name": "golang-1.22-go", "binary_version": "1.22.4-1" }, { "binary_name": "golang-1.22-src", "binary_version": "1.22.4-1" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.21", "binary_version": "1.21.9-1" }, { "binary_name": "golang-1.21-doc", "binary_version": "1.21.9-1" }, { "binary_name": "golang-1.21-go", "binary_version": "1.21.9-1" }, { "binary_name": "golang-1.21-src", "binary_version": "1.21.9-1" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "golang-1.22", "binary_version": "1.22.2-2" }, { "binary_name": "golang-1.22-doc", "binary_version": "1.22.2-2" }, { "binary_name": "golang-1.22-go", "binary_version": "1.22.2-2" }, { "binary_name": "golang-1.22-src", "binary_version": "1.22.2-2" } ] }