2496 matches found
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...
Go net/http2 Uncontrolled Resource Consumption DoS
The vulnerability of the net/http and net/http2 libraries in the Go programming language specifically regarding the implementation of the HTTP/2 protocol is related to an uncontrolled resource consumption due to incorrect determination of the end of headers during the processing of CONTINUATION...
UBUNTU-CVE-2024-22189
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a...
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey and ctx. That functi...
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey and ctx. That functi...
golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body up to 1GiB, causing the receiver to fail reading the response, possibly leading to a Denial of Servic...
Go http2 DoS
The vulnerability of the Go programming language’s http2 package is related to unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...
Go ticket_age_add Unauthorized Access
The vulnerability of the ticketageadd function in the Go programming language is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to session identifiers...
Golang RSA Memory Leak DoS
The vulnerability of the Golang programming language is related to errors in memory release during RSA encryption/decryption code. Exploiting this vulnerability can allow a remote attacker to cause a service failure using specially created data...
google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...
Go jwx Library Resource Consumption DoS
The vulnerability of the Go programming language’s jwx library is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to trigger a service failure using a specially created JSON Web Encryption Token JWE...
PandaX SQL Injection Vulnerability
PandaX is PandaX open source a Go language open source low-code development framework for enterprise IoT platforms. An SQL injection vulnerability exists in PandaX version 20240310 and earlier versions, which stems from the fact that incorrect manipulation of the parameter roleKey can lead to sql...
PandaX Code Issues Vulnerabilities
PandaX is a Go language open source low-code development framework for enterprise IoT platforms from PandaX Open Source. A code issue vulnerability exists in PandaX version 20240310 and prior versions, which stems from an incorrect manipulation of the parameter file can lead to unrestricted file...
golang Denial-of-Service
The vulnerability of the golang package in the Debian GNU/Linux operating system is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to trigger a Denial-of-Service Attack DoS...
golang Denial-of-Service
The vulnerability of the golang package in the Debian GNU/Linux operating system is related to exception handling flaws. Exploiting this vulnerability could allow a malicious actor to trigger a Denial-of-Service attack remotely...
go-jose Compression DoS
The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language is related to incorrect processing of highly compressed input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...
AZL-35762 CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. T...
