24349 matches found
CVE-2023-39325
CVE-2023-39325 describes a DoS in HTTP/2 handling where a malicious client rapidly creates and resets requests, potentially exhausting server resources. The fix tightens per-connection concurrency handling: servers bound the number of executing handler goroutines to the stream-concurrency limit (...
GHSA-4374-P667-P6C8 HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
CVE-2023-39325
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...
GO-2023-2102 HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)
The Palo Alto Networks Product Security Assurance team is evaluating the recently disclosed denial-of-service DoS vulnerabilities in the HTTP/2 protocol including Rapid Reset CVE-2023-44487 and CVE-2023-35945. If HTTP/2 inspection is enabled in PAN-OS, an ongoing distributed denial-of-service DDo...
Google, Cloudflare, and AWS Disclose Largest DDoS Attack in History
By Deeba Ahmed Google, Cloudflare, and AWS Disclosed Digital History’s Largest Ever DDoS Attack- Courtesy HTTP/2 Zero-day. This is a post from HackRead.com Read the original post: Google, Cloudflare, and AWS Disclose Largest DDoS Attack in History...
Microsoft patches 12 critical vulnerabilities, nine of which are in Layer 2 Tunneling Protocol
Microsoft disclosed 104 vulnerabilities in its extensive range of software and services, the most in a single Patch Tuesday since July. What is most notable is that this batch of vulnerabilities includes 12 that are considered "critical," nine of which are remote code execution vulnerabilities in...
Microsoft Releases October 2023 Patches for 103 Flaws, Including 2 Active Exploits
Microsoft has released its Patch Tuesday updates for October 2023, addressing a total of 103 flaws in its software, two of which have come under active exploitation in the wild. Of the 103 flaws, 13 are rated Critical and 90 are rated Important in severity. This is apart from 18 security...
[slackware-security] nghttp2
New nghttp2 packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/nghttp2-1.57.0-i586-1slack15.0.txz: Upgraded. This release has a fix to mitigate the HTTP/2 Rapid Reset vulnerability. For more...
Exploit for Uncontrolled Resource Consumption in Ietf Http
This is a proof of concept for a Denial of Service DoS exploit...
CVE-2023-27533 affecting package rust for versions less than 1.72.0-2
CVE-2023-27533 affecting package rust for versions less than 1.72.0-2. An upgraded version of the package is available that resolves this issue...
CVE-2023-27534 affecting package rust for versions less than 1.72.0-2
CVE-2023-27534 affecting package rust for versions less than 1.72.0-2. An upgraded version of the package is available that resolves this issue...
CVE-2023-0286 affecting package rust for versions less than 1.72.0-2
CVE-2023-0286 affecting package rust for versions less than 1.72.0-2. This CVE either no longer is or was never applicable...
CVE-2022-4304 affecting package rust for versions less than 1.72.0-2
CVE-2022-4304 affecting package rust for versions less than 1.72.0-2. This CVE either no longer is or was never applicable...
CVE-2023-23916 affecting package rust for versions less than 1.72.0-2
CVE-2023-23916 affecting package rust for versions less than 1.72.0-2. An upgraded version of the package is available that resolves this issue...
CVE-2023-32001 affecting package rust for versions less than 1.72.0-2
CVE-2023-32001 affecting package rust for versions less than 1.72.0-2. An upgraded version of the package is available that resolves this issue...
CVE-2023-40030 affecting package rust for versions less than 1.72.0-2
CVE-2023-40030 affecting package rust for versions less than 1.72.0-2. An upgraded version of the package is available that resolves this issue...