Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Summary

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Timeline

1. Feb 28, 2023, 5:19 PM UTCCVE published
2. Apr 23, 2025, 1:26 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. May 5, 2025, 4:12 PM UTCRecord last updated

Affected versions

• net/http

  fixed in 1.19.6; From 1.20.0-0 · fixed in 1.20.1

• golang.org/x/net/http2

  fixed in 0.7.0

• golang.org/x/net/http2/hpack

  fixed in 0.7.0

• golang.org/x/netGo

  fixed in 0.7.0

• stdlibGo

  fixed in 1.19.6; From 1.20.0-0 · fixed in 1.20.1

References 14