net/http, x/net/http2: close connections when receiving too many headers (CVE-2023-45288)

[neild]

Maintaining HPACK state requires that we parse and process all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, we don't allocate memory to store the excess headers but we do parse them. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

Set a limit on the amount of excess header frames we will process before closing a connection.

Thanks to Bartek Nowotarski (https://nowotarski.info/) for reporting this issue.

This is CVE-2023-45288 and Go issue https://go.dev/issue/65051 (this issue).

---

This is a PRIVATE issue for CVE-2023-45288, tracked in http://b/319262343 and fixed by http://tg/2130527.

/cc @golang/security and @golang/release

[neild]

@gopherbot please open backport issues for this security fix.

[gopherbot]

Backport issue(s) opened: #65386 (for 1.20), #65387 (for 1.21), #66298 (for 1.22).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[neild]

We accidentally opened a duplicate issue for this: #66297. Closed that one in favor of keeping the original issue.

Current status: This is the main issue for CVE-2023-45288.
#65387 is the 1.21 backport
#66298 is the 1.22 backport

#65386 was the 1.20 backport, obsolete because we missed the 1.20 window.

[gopherbot]

Change https://go.dev/cl/576076 mentions this issue: [release-branch.go1.22] net/http: update bundled golang.org/x/net/http2

[gopherbot]

Change https://go.dev/cl/576075 mentions this issue: [release-branch.go1.21] net/http: update bundled golang.org/x/net/http2

[gopherbot]

Change https://go.dev/cl/576155 mentions this issue: http2: close connections when receiving too many headers

[gopherbot]

Change https://go.dev/cl/576215 mentions this issue: [internal-branch.go1.22-vendor] http2: close connections when receiving too many headers

[gopherbot]

Change https://go.dev/cl/576057 mentions this issue: [internal-branch.go1.21-vendor] http2: close connections when receiving too many headers

[geofffranks]

@neild @dmitshur Will there be an updated tag released for golang.org/x/net as well?

[benjsmi]

Can someone please clarify something for me? I have a Golang project that relies on net/http and has golang.org/x/net in its go.mod file.

Is it the case that moving my project to Go v1.21.9 is sufficient to address this issue? Or do I ALSO need to run go get -u golang.org/x/[email protected]?

[rolandshoemaker]

It is sufficient, unless you are directly importing the x/net/http2 package and using it to initialize HTTP2 servers.