VDB

RHSA-2023%3A1817

RHSA-2023%3A1817 PUBLISHED CVSS 5.300000190734863 MEDIUM

A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Risk Scores

CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products

VendorProductVersions
Red Hatnetwork-observability/network-observability-flowlogs-pipeline-rhel9@sha256:7a4c88957e6bf8a590c348c83485403c5f675aeb5d7350b9e2c9c4a2a08f8fab_amd64 as a component of NETOBSERV 1.2 for RHEL 9network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:7a4c88957e6bf8a590c348c83485403c5f675aeb5d7350b9e2c9c4a2a08f8fab_amd64, *, network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:7a4c88957e6bf8a590c348c83485403c5f675aeb5d7350b9e2c9c4a2a08f8fab_amd64
Red Hatnetwork-observability/network-observability-console-plugin-rhel9@sha256:9841f72ea873e85c91a4ac05c286c9c708c362c7a984753d6c7664a454df1cf3_amd64 as a component of NETOBSERV 1.2 for RHEL 9*, network-observability/network-observability-console-plugin-rhel9@sha256:9841f72ea873e85c91a4ac05c286c9c708c362c7a984753d6c7664a454df1cf3_amd64
Red Hatnetwork-observability/network-observability-flowlogs-pipeline-rhel9@sha256:7a4c88957e6bf8a590c348c83485403c5f675aeb5d7350b9e2c9c4a2a08f8fab_amd64 as a component of NETOBSERV 1.2 for RHEL 9network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:7a4c88957e6bf8a590c348c83485403c5f675aeb5d7350b9e2c9c4a2a08f8fab_amd64, *
Red Hatnetwork-observability/network-observability-operator-bundle@sha256:9ba226d0207edd7c9173333647353d3a7a0b5bfc32feb60ca5749dd6dc190c28_amd64 as a component of NETOBSERV 1.2 for RHEL 9*, network-observability/network-observability-operator-bundle@sha256:9ba226d0207edd7c9173333647353d3a7a0b5bfc32feb60ca5749dd6dc190c28_amd64, *
Red Hatnetwork-observability/network-observability-operator-bundle@sha256:9ba226d0207edd7c9173333647353d3a7a0b5bfc32feb60ca5749dd6dc190c28_amd64
Red Hatnetwork-observability/network-observability-rhel9-operator@sha256:b52ce219650214e89e00dfbf092b0d3f3d9c16e2d9ffcf6e67a3b57ae21c3082_amd64 as a component of NETOBSERV 1.2 for RHEL 9network-observability/network-observability-rhel9-operator@sha256:b52ce219650214e89e00dfbf092b0d3f3d9c16e2d9ffcf6e67a3b57ae21c3082_amd64, network-observability/network-observability-rhel9-operator@sha256:b52ce219650214e89e00dfbf092b0d3f3d9c16e2d9ffcf6e67a3b57ae21c3082_amd64
Red Hatnetwork-observability/network-observability-operator-bundle@sha256:9ba226d0207edd7c9173333647353d3a7a0b5bfc32feb60ca5749dd6dc190c28_amd64 as a component of NETOBSERV 1.2 for RHEL 9network-observability/network-observability-operator-bundle@sha256:9ba226d0207edd7c9173333647353d3a7a0b5bfc32feb60ca5749dd6dc190c28_amd64, network-observability/network-observability-operator-bundle@sha256:9ba226d0207edd7c9173333647353d3a7a0b5bfc32feb60ca5749dd6dc190c28_amd64
Red Hatnetwork-observability/network-observability-ebpf-agent-rhel9@sha256:93ad940d2d50b01302a3f9af32895caa5cdd6623b50a963629dcf653e374a610_amd64 as a component of NETOBSERV 1.2 for RHEL 9network-observability/network-observability-ebpf-agent-rhel9@sha256:93ad940d2d50b01302a3f9af32895caa5cdd6623b50a963629dcf653e374a610_amd64, network-observability/network-observability-ebpf-agent-rhel9@sha256:93ad940d2d50b01302a3f9af32895caa5cdd6623b50a963629dcf653e374a610_amd64
Red Hatnetwork-observability/network-observability-rhel9-operator@sha256:b52ce219650214e89e00dfbf092b0d3f3d9c16e2d9ffcf6e67a3b57ae21c3082_amd64 as a component of NETOBSERV 1.2 for RHEL 9network-observability/network-observability-rhel9-operator@sha256:b52ce219650214e89e00dfbf092b0d3f3d9c16e2d9ffcf6e67a3b57ae21c3082_amd64, network-observability/network-observability-rhel9-operator@sha256:b52ce219650214e89e00dfbf092b0d3f3d9c16e2d9ffcf6e67a3b57ae21c3082_amd64, *
Red Hatnetwork-observability/network-observability-console-plugin-rhel9@sha256:9841f72ea873e85c91a4ac05c286c9c708c362c7a984753d6c7664a454df1cf3_amd64 as a component of NETOBSERV 1.2 for RHEL 9*, network-observability/network-observability-console-plugin-rhel9@sha256:9841f72ea873e85c91a4ac05c286c9c708c362c7a984753d6c7664a454df1cf3_amd64, network-observability/network-observability-console-plugin-rhel9@sha256:9841f72ea873e85c91a4ac05c286c9c708c362c7a984753d6c7664a454df1cf3_amd64
Red Hatnetwork-observability/network-observability-ebpf-agent-rhel9@sha256:93ad940d2d50b01302a3f9af32895caa5cdd6623b50a963629dcf653e374a610_amd64 as a component of NETOBSERV 1.2 for RHEL 9*, network-observability/network-observability-ebpf-agent-rhel9@sha256:93ad940d2d50b01302a3f9af32895caa5cdd6623b50a963629dcf653e374a610_amd64, network-observability/network-observability-ebpf-agent-rhel9@sha256:93ad940d2d50b01302a3f9af32895caa5cdd6623b50a963629dcf653e374a610_amd64

Timeline

  • Apr 18, 2023 CVE Published
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Distribution Patch
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • May 8, 2026 CVE Updated

References

…and 23 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›