CVE-2023-39326 — Uncontrolled Resource Consumption

Vendor	Product	Version range	Fixed in
debian	golang-1.15	—	—
debian	golang-1.19	—	—
go_standard_library	net_http_internal	< 1.20.12	1.20.12
go_standard_library	net_http_internal	>= 1.21.0-0 < 1.21.5	1.21.5
golang	go	< 1.20.12	1.20.12
golang	go	>= 1.21.0-0 < 1.21.5	1.21.5
msrc	azl3_gcc_13.2.0-7_on_azure_linux_3.0	—	—
msrc	azl3_golang_1.24.3-1_on_azure_linux_3.0	—	—
msrc	azl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0	—	—
msrc	azl3_tensorflow_2.16.1-9_on_azure_linux_3.0	—	—
msrc	cbl2_gcc_11.2.0-8_on_cbl_mariner_2.0	—	—
msrc	cbl2_golang_1.17.13-2_on_cbl_mariner_2.0	—	—
msrc	cbl2_golang_1.18.8-7_on_cbl_mariner_2.0	—	—
msrc	cbl2_golang_1.21.5-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_golang_1.21.6-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_msft-golang_1.21.5-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0	—	—
msrc	cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0	—	—
paloalto	pan-os	—	—

OSV

Go vulnerabilities

osv·2024-01-11·CVSS 6.1

CVE-2023-39318 [MEDIUM] Go vulnerabilities Go vulnerabilities Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319) It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323) It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly use this issue to cause a panic resulting into a denial of se

OSV

Denial of service via chunk extensions in net/http

osv·2023-12-06

CVE-2023-39326 Denial of service via chunk extensions in net/http Denial of service via chunk extensions in net/http A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded b

GHSA

GHSA-9f76-wg39-x86h: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network

ghsa_unreviewed·2023-12-06

CVE-2023-39326 [MEDIUM] GHSA-9f76-wg39-x86h: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

OSV

CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network

osv·2023-12-06·CVSS 5.3

CVE-2023-39326 [MEDIUM] CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

Palo Alto

PAN-SA-2024-0013 Informational Bulletin: Impact of OSS CVEs in PAN-OS

vendor_paloalto·2024-11-01·CVSS 9.8

CVE-2017-12424 [CRITICAL] PAN-SA-2024-0013 Informational Bulletin: Impact of OSS CVEs in PAN-OS PAN-SA-2024-0013 Informational Bulletin: Impact of OSS CVEs in PAN-OS The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the CVEs: CVE-2017-12424, CVE-2021-3114, CVE-2021-31525, CVE-2021-33195, CVE-2021-33197, CVE-2021-33198, CVE-2021-34558, CVE-2021-36221, CVE-2021-4034, CVE-2021-44716, CVE-2021-44717, CVE-2022-1664, CVE-2022-1705, CVE-2022-23772, CVE-2022-24675, CVE-2022-24921, CVE-2022-28327, CVE-2022-2880, CVE-2022-29526, CVE-2022-30629, CVE-2022-30631, CVE-2022-30632, CVE-2022-32148, CVE-2022-32189, CVE-2022-41715, CVE-2022-41717, CVE-2022-41724, CVE-2022-41725, CVE-2023-24534, CVE-2023-24536, CVE-2023-24539, CVE-2023-29406, CVE-2023-29409, CVE-2023-39

Ubuntu

Go vulnerabilities

vendor_ubuntu·2024-01-11·CVSS 6.1

CVE-2023-39326 [MEDIUM] Go vulnerabilities Title: Go vulnerabilities Summary: Several security issues were fixed in Go. Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319) It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323) It was discovered that Go did not limit the number of simultaneously executing handler goroutines in the net/http module. An attacker could possibly us

Microsoft

Denial of service via chunk extensions in net/http

vendor_msrc·2023-12-12·CVSS 5.3

CVE-2023-39326 [MEDIUM] Denial of service via chunk extensions in net/http Denial of service via chunk extensions in net/http FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner Go: Go Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.

Red Hat

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

vendor_redhat·2023-12-06·CVSS 5.3

CVE-2023-39326 [MEDIUM] CWE-400 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an err

Debian

CVE-2023-39326: golang-1.15 - A malicious HTTP sender can use chunk extensions to cause a receiver reading fro...

vendor_debian·2023·CVSS 5.3

CVE-2023-39326 [MEDIUM] CVE-2023-39326: golang-1.15 - A malicious HTTP sender can use chunk extensions to cause a receiver reading fro... A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Scope: local bullseye: open

CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are…

Affected

CVSS provenance