golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

Moderate: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

grafana-pcp security and enhancement update

5.1.1-1 - update to 5.1.1 tagged upstream community sources, see CHANGELOG - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY 5.0.0-4 - update to 5.0.0 tagged upstream community sources, see CHANGELOG - install plugin in /usr/share and create symlink from /var...

golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

Denial Of Service (DoS)

github.com/golang/net is vulnerable to Denial Of Service DoS. The vulnerability exists in goAway function in server.go because the server errors are not properly handled which allows an attacker to cause an application crash...

Improper Resource Shutdown or Release in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOWUPDATE before allowing the application to write more data. These waiting streams each...

GHSA-9785-W233-X6HV Improper Resource Shutdown or Release in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOWUPDATE before allowing the application to write more data. These waiting streams each...

Denial of Service (DoS)

Overview grpc/grpc-swift is a Swift language implementation of gRPC. Affected versions of this package are vulnerable to Denial of Service DoS via reachable assertion, due to an incorrect logic when handling GOAWAY frames. Details Denial of Service DoS describes a family of attacks, all aimed at...

Code injection

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

grpc 安全漏洞

grpc is a Cloud Native Computing Foundation codebase for rpc connectivity applications. A security vulnerability exists in grpc-swift versions prior to 1.7.2, which stems from incorrect logic when handling GOAWAY frames...

PT-2022-16872 · Unknown · Grpc Swift

Name of the Vulnerable Software and Affected Versions: grpc-swift versions prior to 1.7.2 Description: The issue is a denial of service attack via a reachable assertion, caused by incorrect logic when handling GOAWAY frames. This attack requires minimal resources to construct and send the require...

CVE-2022-24777: Reachable Assertion

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2021-39162

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

Caleb Doxsey pomerium 代码问题漏洞

Caleb Doxsey pomerium is a Caleb Doxsey open source application. An identity agent that allows secure access to internal applications. A code issue vulnerability exists in Pomerium that stems from the fact that the Envoy on which Pomerium is based may terminate abnormally if an H/2 GOAWAY and...

CVE-2021-39162: Improper Check for Unusual or Exceptional Conditions

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

CVE-2021-32780 Incorrect handling of H/2 GOAWAY followed by SETTINGS frames

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to...

PT-2021-19926 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.18.4 Envoy versions prior to 1.19.1 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions, Envoy transitions a H/2 connecti...