HTTP/2 CONTINUATION flood in net/http

Summary

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Timeline

1. Apr 4, 2024, 8:37 PM UTCCVE published
2. Apr 5, 2024, 5:08 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Nov 4, 2025, 6:17 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• net/http

  fixed in 1.21.9; From 1.22.0-0 · fixed in 1.22.2

• golang.org/x/net/http2

  fixed in 0.23.0

• stdlibGo

  fixed in 1.21.9; From 1.22.0-0 · fixed in 1.22.2

• golang.org/x/netGo

  fixed in 0.23.0

• net/httpGo

  fixed in 1.21.9

• golang.org/x/net/http2Go

  fixed in 0.23.0

• net/httpGo

  From 1.22.0-0 · fixed in 1.22.2

References 9