CVE-2023-39325: HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.
With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.
This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.
The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
Other sources
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.
This CVE is specific to golang, but is also tracked as CVE-2023-44487.
— Red Hat
HTTP/2 rapid reset can cause excessive work in net/http
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/netto a version that resolves this vulnerability.Fixed in 0.17.0 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.21.3 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.20.10 - Upgrade
Upgrade
golang/net/http2to a version that resolves this vulnerability.Patch CVE-2023-44487 - Configuration
Adjust HTTP/2 stream concurrency using golang.org/x/net/http2 Server.MaxConcurrentStreams (via ConfigureServer / ConfigureServer function) to limit concurrent handler execution; the default is 250 streams per HTTP/2 connection.
golang.org/x/net/http2 Server.MaxConcurrentStreams = (set to an appropriate lower concurrency limit) - Compensating control
Add network/edge controls to limit abusive rapid HTTP/2 connections/requests (rate limiting / WAF / connection limiting) so attackers cannot repeatedly reset in-flight requests to drive excessive server resource consumption.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-39325.
What can cause excessive server resource consumption?
A malicious HTTP/2 client that rapidly creates requests and immediately resets them can cause excessive server resource consumption.
How can the attacker create new requests?
By resetting an in-progress request, the attacker can create a new request.
What is the affected software?
The affected software is golang.org/x/net version 0.17.0.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [GitHub Issue](https://github.com/golang/go/issues/63417), [Code Change 1](https://go.dev/cl/534215), [Code Change 2](https://go.dev/cl/534235).