CVE-2023-45288

HTTP/2 CONTINUATION flood in net/http

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

CVSS 3.1 · 7.5 High EPSS 89.5% KEV · Not listed

Vendors

Go Standard Library Golang Redhat

Products

Net\/http Http2 Acm and 30 more

CVE-2024-24784

Comments in display names are incorrectly handled in net/mail

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Go Standard Library Redhat

Products

Net\/mail Advanced Cluster Security Ceph Storage and 11 more

CVE-2023-45289

Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Advanced Cluster Security Enterprise Linux Logging and 9 more

CVE-2024-12401

Cert-manager: potential dos when parsing specially crafted pem inputs

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cert Manager Connectivity Link Cryostat and 5 more

CVE-2025-10894

Nx: nx/devkit: malicious versions of nx and plugins published to npm

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Acm Ansible Automation Platform Multicluster Globalhub and 1 more

CVE-2023-45290

Memory exhaustion in multipart form parsing in net/textproto and net/http

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat

Products

Advanced Cluster Security Ansible Automation Platform Ceph Storage and 17 more

CVE-2024-24785

Errors returned from JSON marshaling may break template escaping in html/template

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ceph Storage Enterprise Linux Kube Descheduler Operator and 15 more

CVE-2022-30633

Stack exhaustion when unmarshaling certain documents in encoding/xml

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 11 more

CVE-2022-32148

Exposure of client IP addresses in net/http

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 16 more

CVE-2022-30629

Session tickets lack random ticket_age_add in crypto/tls

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

CVSS 3.1 · 3.1 Low EPSS 1.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ceph Storage and 12 more

CVE-2022-1962

Stack exhaustion due to deeply nested types in go/parser

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 13 more

CVE-2022-30635

Stack exhaustion when decoding certain messages in encoding/gob

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ceph Storage and 12 more

CVE-2022-30630

Stack exhaustion in Glob on certain paths in io/fs

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 14 more

CVE-2022-1705

Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 19 more

CVE-2022-22963

spring-cloud-function: Remote code execution by malicious Spring Expression

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Listed

Vendors

Oracle Redhat Vmware

Products

Banking Branch Banking Cash Management Banking Corporate Lending Process Management and 26 more

CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 18 more

CVE-2023-49568

Maliciously crafted Git server replies can cause DoS on go-git clients

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go-git Project Redhat

Products

Go-git Acm Advanced Cluster Security and 7 more

CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Golang Redhat

Products

Go Hpack Http2 and 19 more

CVE-2022-21698

Uncontrolled Resource Consumption in promhttp

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

CVSS 3.1 · 7.5 High EPSS 6.0% KEV · Not listed

Vendors

Fedoraproject Prometheus Rdo Project and 1 more

Products

Extra Packages For Enterprise Linux Fedora Client Golang and 14 more

CVE-2023-25173

containerd supplementary groups are not set up properly

containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Linuxfoundation Redhat

Products

Containerd Container Native Virtualization Enterprise Linux and 6 more