CVE-2021-31525

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

Published May 27, 2021 CVSS 3.1 · 5.9 Medium EPSS 3.7% KEV · Not listed
Description
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4104 net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Github GHSA Github GHSA GHSA-h86h-8ppg-mxmh golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion
History

No history.