Vulnerability · Published Apr 6, 2023 · Assigned by Go
CVE-2023-24534Excessive memory allocation in net/http and net/textproto
High 7.5
In plain English
A high-severity uncontrolled resource consumption in net/textproto from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.9%top 20.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.7.0-1.module_el8.9.0+3657+d86e192f | ALSA-2023:6939 |
| AlmaLinux:8 | aardvark-dns | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | buildah | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | buildah | 1:1.31.3-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | buildah | 1:1.31.3-1.el9 | ALSA-2023:6473 |
| AlmaLinux:8 | buildah-tests | 1:1.31.3-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | buildah-tests | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:9 | buildah-tests | 1:1.31.3-1.el9 | ALSA-2023:6473 |
| AlmaLinux:8 | cockpit-podman | 75-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:6938 |
| AlmaLinux:8 | conmon | 3:2.1.8-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | conmon | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | container-selinux | 2:2.205.0-3.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | container-selinux | 2:2.221.0-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.1.1-5.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.3.0-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | containernetworking-plugins | 1:1.3.0-4.el9 | ALSA-2023:6402 |
| AlmaLinux:8 | containers-common | 2:1-38.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | containers-common | 2:1-54.module_el8.9.0+3673+0c64b403 | ALSA-2023:6939 |
| AlmaLinux:8 | crit | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | criu | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | criu-devel | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | criu-libs | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | crun | 1.8.3-1.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | crun | 1.8.7-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | fuse-overlayfs | 1.12-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | fuse-overlayfs | 1.9-2.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:9 | grafana | 9.2.10-7.el9_3.alma.1 | ALSA-2023:6420 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.8.0+3615+3543c705 | ALSA-2023:6939 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.8.0+3615+3543c705 | ALSA-2023:6939 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | netavark | 2:1.7.0-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | netavark | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.9-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2023:6938 |
| AlmaLinux:8 | podman | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | podman | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | podman | 2:4.6.1-5.el9 | ALSA-2023:6474 |
| AlmaLinux:8 | podman-catatonit | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | podman-catatonit | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | podman-docker | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | podman-docker | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:9 | podman-docker | 2:4.6.1-5.el9 | ALSA-2023:6474 |
| AlmaLinux:8 | podman-gvproxy | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | podman-gvproxy | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:9 | podman-gvproxy | 2:4.6.1-5.el9 | ALSA-2023:6474 |
| AlmaLinux:8 | podman-plugins | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | podman-plugins | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:9 | podman-plugins | 2:4.6.1-5.el9 | ALSA-2023:6474 |
| AlmaLinux:8 | podman-remote | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | podman-remote | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | podman-remote | 2:4.6.1-5.el9 | ALSA-2023:6474 |
| AlmaLinux:8 | podman-tests | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | podman-tests | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | podman-tests | 2:4.6.1-5.el9 | ALSA-2023:6474 |
| AlmaLinux:8 | python3-criu | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:6938 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2023:6938 |
| AlmaLinux:8 | python3-podman | 4.0.0-2.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | python3-podman | 4.6.0-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | runc | 1:1.1.9-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | runc | 1:1.1.5-2.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | skopeo | 2:1.6.2-8.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | skopeo | 2:1.13.3-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | skopeo | 2:1.13.3-1.el9 | ALSA-2023:6363 |
| AlmaLinux:8 | skopeo-tests | 2:1.6.2-8.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | skopeo-tests | 2:1.13.3-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | skopeo-tests | 2:1.13.3-1.el9 | ALSA-2023:6363 |
| AlmaLinux:8 | slirp4netns | 1.2.1-1.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:8 | slirp4netns | 1.1.8-3.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | toolbox | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | toolbox | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | toolbox | 0.0.99.4-6.el9_3 | ALSA-2023:6346 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b | ALSA-2023:6939 |
| AlmaLinux:9 | toolbox-tests | 0.0.99.4-6.el9_3 | ALSA-2023:6346 |
| AlmaLinux:8 | udica | 0.2.6-20.module_el8.8.0+3615+3543c705 | ALSA-2023:6939 |
| AlmaLinux:8 | udica | 0.2.6-4.module_el8.9.0+3627+db8ec155 | ALSA-2023:6938 |
| Alpine:v3.20 | go | 1.20.3-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.21 | go | 1.20.3-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.22 | go | 1.20.3-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.23 | go | 1.20.3-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.24 | go | 1.20.3-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.20 | traefik | 2.9.10-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.21 | traefik | 2.9.10-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.22 | traefik | 2.9.10-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.23 | traefik | 2.9.10-r0 | ALPINE-CVE-2023-24534 |
| Alpine:v3.24 | traefik | 2.9.10-r0 | ALPINE-CVE-2023-24534 |
| Debian:12 | golang-1.19 | 1.19.8-2 | DEBIAN-CVE-2023-24534 |
| Go | stdlib | 1.19.8, 1.20.3 | GO-2023-1704 |
| Rocky Linux:8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | cockpit-podman | 0:46-1.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | containernetworking-plugins | 1:1.1.1-5.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | crun | 0:1.8.3-1.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.9-2.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2023:6939 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | podman | 2:4.0.2-24.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | python-podman | 0:4.0.0-2.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | runc | 1:1.1.5-2.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-3.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Rocky Linux:8 | udica | 0:0.2.6-4.module+el8.9.0+1445+07728297 | RLSA-2023:6938 |
| Ubuntu:22.04:LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.2 | USN-6038-2 |
| Ubuntu:22.04:LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.2 | UBUNTU-CVE-2023-24534 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2023-24534 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.1 | USN-6038-1 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.1 | UBUNTU-CVE-2023-24534 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/textproto | 0 – before 1.19.81.20.0-0 – before 1.20.3 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H