Home

CVE-2021-44716

Description

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.095

Associated Vulnerability

VulnerabilityOS Platform
Multiple Vulnerabilities are affected in IBM Spectrum Protect Server 8.1.13Windows
Delve update (ELSA-2021-5160) delve-1.6.0-1.0.1.module+el8.5.0+20332+2a8a7cc5.x86_64.rpmLinux
Go-toolset update (ELSA-2021-5160) go-toolset-1.16.12-1.module+el8.5.0+20456+eee863d9.x86_64.rpmLinux
Golang update (ELSA-2021-5160) golang-1.16.12-1.module+el8.5.0+20456+eee863d9.x86_64.rpmLinux
Golang-bin update (ELSA-2021-5160) golang-bin-1.16.12-1.module+el8.5.0+20456+eee863d9.x86_64.rpmLinux
Golang-docs update (ELSA-2021-5160) golang-docs-1.16.12-1.module+el8.5.0+20456+eee863d9.noarch.rpmLinux
Golang-misc update (ELSA-2021-5160) golang-misc-1.16.12-1.module+el8.5.0+20456+eee863d9.noarch.rpmLinux
Golang-race update (ELSA-2021-5160) golang-race-1.16.12-1.module+el8.5.0+20456+eee863d9.x86_64.rpmLinux
Golang-src update (ELSA-2021-5160) golang-src-1.16.12-1.module+el8.5.0+20456+eee863d9.noarch.rpmLinux
Golang-tests update (ELSA-2021-5160) golang-tests-1.16.12-1.module+el8.5.0+20456+eee863d9.noarch.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update delve-debugsource-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update go-toolset-1.16.12-1.module+el8.5.0+13637+960c7771.x86_64.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-1.16.12-1.module+el8.5.0+13637+960c7771.x86_64.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-bin-1.16.12-1.module+el8.5.0+13637+960c7771.x86_64.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-docs-1.16.12-1.module+el8.5.0+13637+960c7771.noarch.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-misc-1.16.12-1.module+el8.5.0+13637+960c7771.noarch.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-race-1.16.12-1.module+el8.5.0+13637+960c7771.x86_64.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-src-1.16.12-1.module+el8.5.0+13637+960c7771.noarch.rpmLinux
(RHSA-2021:5160) go-toolset:rhel8 security and bug fix update golang-tests-1.16.12-1.module+el8.5.0+13637+960c7771.noarch.rpmLinux
Grafana update (ELSA-2022-0001) grafana-7.5.9-5.el8_5.x86_64.rpmLinux
Grafana update (ELSA-2023-6420) grafana-9.2.10-7.el9_3.x86_64.rpmLinux
Podman update (ELSA-2023-6474) podman-4.6.1-5.0.1.el9.x86_64.rpmLinux
Podman-docker update (ELSA-2023-6474) podman-docker-4.6.1-5.0.1.el9.noarch.rpmLinux
Podman-gvproxy update (ELSA-2023-6474) podman-gvproxy-4.6.1-5.0.1.el9.x86_64.rpmLinux
Podman-plugins update (ELSA-2023-6474) podman-plugins-4.6.1-5.0.1.el9.x86_64.rpmLinux
Podman-remote update (ELSA-2023-6474) podman-remote-4.6.1-5.0.1.el9.x86_64.rpmLinux
Podman-tests update (ELSA-2023-6474) podman-tests-4.6.1-5.0.1.el9.x86_64.rpmLinux
Grafana update (ELSA-2023-6972) grafana-9.2.10-7.el8_9.x86_64.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-1.19.3-2.amzn2023.0.2.x86_64.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-bin-1.19.3-2.amzn2023.0.2.x86_64.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-docs-1.19.3-2.amzn2023.0.2.noarch.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-misc-1.19.3-2.amzn2023.0.2.noarch.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-race-1.19.3-2.amzn2023.0.2.x86_64.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-shared-1.19.3-2.amzn2023.0.2.x86_64.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-src-1.19.3-2.amzn2023.0.2.noarch.rpmLinux
golang Security Update (ALAS2023-2023-048) golang-tests-1.19.3-2.amzn2023.0.2.noarch.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234