Skip to main content
cve.nowby Sazabi
← Go
GoPackage

golang.org/x/net/http2

8 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 4 high
Registry
pkg.go.dev

Advisories 8

  • Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

    Affected: fixed in 0.53.0.

  • Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

    Affected: from 0.50.0, fixed in 0.51.0.

  • HTTP/2 CONTINUATION flood in net/http

    Affected: fixed in 0.23.0; fixed in 0.23.0.

  • HTTP/2 rapid reset can cause excessive work in net/http

    Affected: fixed in 0.17.0.

  • Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

    Affected: fixed in 0.7.0.

  • Excessive memory growth in net/http and golang.org/x/net/http2

    Affected: fixed in 0.4.0; fixed in 0.4.0.

  • In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…

    Affected: fixed in 0.0.0-20220906165146-f3363e06e74c.

  • net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via…

    Affected: fixed in 0.0.0-20211209124913-491a49abca63.