CVE-2021-31525: Input Validation
A vulnerability was detected in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and subsequent denial of service. This vulnerability affects both clients and servers written in Go, however, servers are only vulnerable if the value of MaxHeaderBytes has been increased from the default.
Other sources
Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted header to ReadRequest or ReadResponse. Server, Transport, and Client, a remote attacker could exploit this vulnerability to cause a (panic) denial of service condition.
— IBM
golang.org/x/net/http/httpguts in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
— GitHub
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
ReadRequest and ReadResponse in net/http can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.
Reference: https://github.com/golang/go/issues/45710
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-31525?
CVE-2021-31525 is a vulnerability in net/http of the Go standard library that allows remote attackers to cause a denial of service.
Which software is affected by CVE-2021-31525?
The vulnerability affects net/http in Go before 1.15.12 and 1.16.x before 1.16.4.
How does CVE-2021-31525 impact servers?
Servers written in Go are vulnerable to CVE-2021-31525 only if the value of MaxHeaderBytes has been increased, which is not the default configuration.
How can I fix CVE-2021-31525?
To fix CVE-2021-31525, upgrade to Go version 1.15.12 or 1.16.4.
Where can I find more information about CVE-2021-31525?
More information about CVE-2021-31525 can be found on the NIST National Vulnerability Database (NVD) and the official Go GitHub page.