golang: net/http, net/textproto: denial of service from excessive memory allocation

🗓️ 10 Jul 2023 09:56:57Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 7 Views

Golang HTTP and MIME header parsing memory exhaustion flaw causing denial of service.

Reporter	Title	Published	Views	Family All 376
FreeBSD	traefik -- Use of vulnerable Go modules net/http, net/textproto	10 Mar 202300:00	–	freebsd
FreeBSD	go -- multiple vulnerabilities	4 Apr 202300:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple ansible-operator and opm vulnerabilities	20 Feb 202419:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in GoLang Go and Kubernetes affect IBM watsonx.data	18 Sep 202416:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is vulnerable to denial of service due to Golang Go ( CVE-2023-24534 )	29 Jan 202521:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2023-24534)	27 Jul 202317:34	–	ibm
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to denial of service due to Go (CVE-2023-24534)	29 Jan 202521:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Golang Go affect Cloud Pak System	2 Jan 202411:59	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2023-24536, CVE-2023-24537 and CVE-2023-24534 may affect IBM CICS TX Standard	9 May 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by multiple vulnerabilities in Golang Go	26 Jul 202320:48	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	x86_64	skupper-cli	1.4.1-2.el8	skupper-cli-1.4.1-2.el8.x86_64.rpm
Red Hat Enterprise Linux	9	x86_64	skupper-cli	1.4.1-2.el9	skupper-cli-1.4.1-2.el9.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-24534
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/issue/58975
groups	www.groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-24534
cve	www.cve.org/CVERecord

01 Aug 2026 02:40Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.01888

SSVC

golang header parsing memory exhaustion denial of service internet mail extensions