CVE-2023-24534
Excessive memory allocation in net/http and net/textproto
7.5
HIGH
CVSS 3.1
EPSS 1.9%
描述
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
如何修補 CVE-2023-24534
要修補 CVE-2023-24534,請將受影響套件升級到下列已修補版本。
- —升級至 1.19.8 或更新版本
- —未列出修補版本
- —升級至 1.19.8-2 或更新版本
- —升級至 1.19.8 或更新版本
CVE-2023-24534 正在被利用嗎?
低 — EPSS 為 1.9%,目前沒有觀察到大規模利用活動。
受影響套件(4)
- from 0, < 1.19.8, >= 1.20.0, < 1.20.3
- from 0
- from 0, < 1.19.8-2
- from 0, < 1.19.8, >= 1.20.0-0, < 1.20.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |