Vulnerability-Lookup

RHBA-2024:2646

Vulnerability from csaf_redhat - Published: 2024-05-01 22:22 - Updated: 2026-08-14 10:32

Summary

Red Hat Bug Fix Advisory: LVMS 4.14.5 Bug Fix Update

Severity

Important

Notes

Topic: Updated container images that fix multiple bugs are now available for LVMS 4.14

Details: Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to dynamically provision thin and thick local storage on a cluster with limited resources. Users of LVMS are advised to upgrade to the latest version of LVMS in OpenShift Container Platform, which fixes bugs and security vulnerabilities.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-45288

A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 16 products

Product	Version	Remediation
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

9 references

URL	Category
https://access.redhat.com/errata/RHBA-2024:2646	self
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-45288	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268273	external
https://www.cve.org/CVERecord?id=CVE-2023-45288	external
https://nvd.nist.gov/vuln/detail/CVE-2023-45288	external
https://nowotarski.info/http2-continuation-flood/	external
https://pkg.go.dev/vuln/GO-2024-2687	external
https://www.kb.cert.org/vuls/id/421644	external

Acknowledgments

nowotarski.info Bartek Nowotarski

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images that fix multiple bugs are now available for LVMS\n4.14",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to\ndynamically provision thin and thick local storage on a cluster with\nlimited resources.\n\nUsers of LVMS are advised to upgrade to the latest version of LVMS in\nOpenShift Container Platform, which fixes bugs and security vulnerabilities.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2024:2646",
        "url": "https://access.redhat.com/errata/RHBA-2024:2646"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_2646.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: LVMS 4.14.5 Bug Fix Update",
    "tracking": {
      "current_release_date": "2026-08-14T10:32:35+00:00",
      "generator": {
        "date": "2026-08-14T10:32:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.15"
        }
      },
      "id": "RHBA-2024:2646",
      "initial_release_date": "2024-05-01T22:22:37+00:00",
      "revision_history": [
        {
          "date": "2024-05-01T22:22:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-05-01T22:22:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-14T10:32:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "LVMS 4.14 for RHEL 9",
                "product": {
                  "name": "LVMS 4.14 for RHEL 9",
                  "product_id": "9Base-LVMS-4.14",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:lvms:4.14::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "logical volume manager storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.14.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
                  "product_id": "lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.14.5-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.14.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
                  "product_id": "lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.14.5-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.14.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
                  "product_id": "lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.14.5-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.14.5-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.14.5-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64",
                  "product_id": "lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.14.5-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64 as a component of LVMS 4.14 for RHEL 9",
          "product_id": "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.14"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Bartek Nowotarski"
          ],
          "organization": "nowotarski.info"
        }
      ],
      "cve": "CVE-2023-45288",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268273"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or  significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
          "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
          "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
          "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
          "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
          "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
          "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
          "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
          "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
          "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
          "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
          "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
          "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
          "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
          "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
          "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268273",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "https://nowotarski.info/http2-continuation-flood/",
          "url": "https://nowotarski.info/http2-continuation-flood/"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2687",
          "url": "https://pkg.go.dev/vuln/GO-2024-2687"
        },
        {
          "category": "external",
          "summary": "https://www.kb.cert.org/vuls/id/421644",
          "url": "https://www.kb.cert.org/vuls/id/421644"
        }
      ],
      "release_date": "2024-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-05-01T22:22:37+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:2646"
        },
        {
          "category": "workaround",
          "details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.",
          "product_ids": [
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:12d2d04ec793b36e031bfe67df77afb815133faa0374999ff1a83d6b8cb1cbf4_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:497a689e898ace0a2e3b7f7a9b6f51e2f81f7fa5b4c45ec4c514e02cf25fa76c_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:7d4fc9165c9803a3216709a0dc53e76a0461d403f8dfb7cd28aa9551d54b6ba2_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-must-gather-rhel9@sha256:bac397b05c11813f300f1dd97270fcec86c6c6731e7de639c0c537dd0325a3bd_amd64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:22dbd5d21e324f841df4c1f217858f56a4389538b2473f176772b0bf2cac0009_amd64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:597a0a8fb5beaf217cf019c8a60cbc696d2cf22742b2da8d690d40d1c6c6be01_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:995379d05cc39881ab5e9d2bd043617bb20fb85bebf22da3da69fd73ab79563f_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-operator-bundle@sha256:ef754bda8220ce137caaf7e7ef2851dc3c2de48985af75d62ea61766239889e6_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:5688b13ece8a9d872db73853035b35cd72b6b5c6492012d01620302ee5afe264_ppc64le",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:69a6af5317fdc29919e2f431856fd8219354db5b6d8c2b7e6c8fe20d7b85b1bf_s390x",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:72f0fda985bef8badd41dad13b031013b6efa6e4930aa6e8f34a2ecc68d7230b_arm64",
            "9Base-LVMS-4.14:lvms4/lvms-rhel9-operator@sha256:a8ca87c72771ba4c02e027f0da5b3c15f0e29089df90fb66dbc2035574cdaf59_amd64",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:10bd442750db361d7854b430b26a21a0908ebdeae9f7ba25cb0802877a454620_s390x",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:603cf632d59732b05533b2ae7640fd1543400249fa53378bd7dfac86771adab7_arm64",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:98b45141391b5bb2ee0466c780716b2903b4ed16aef1124b588ffa882782f125_ppc64le",
            "9Base-LVMS-4.14:lvms4/topolvm-rhel9@sha256:da81cf0dc341e35a860ccbe49d84eb454fde20b4fc7fe0802ec50957026efad1_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS"
    }
  ]
}

CVE-2023-45288 (GCVE-0-2023-45288)

Vulnerability from cvelistv5 – Published: 2024-04-04 20:37 – Updated: 2025-11-04 18:17

Title

HTTP/2 CONTINUATION flood in net/http

Summary

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-05 17:08 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

9 references

URL	Tags
https://go.dev/issue/65051
https://go.dev/cl/576155
https://groups.google.com/g/golang-announce/c/YgW…
https://pkg.go.dev/vuln/GO-2024-2687
https://security.netapp.com/advisory/ntap-2024041…
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2024/04/05/4
http://www.openwall.com/lists/oss-security/2024/0…
https://www.kb.cert.org/vuls/id/421644

Impacted products

4 products

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.21.9 (semver) Affected: 1.22.0-0 , < 1.22.2 (semver)
golang.org/x/net	golang.org/x/net/http2	Affected: 0 , < 0.23.0 (semver)
go_standard_library	net\/http	Affected: 0 , < 1.21.9 (custom) Affected: 1.22.0-0 , < 1.22.2 (custom) cpe:2.3:a:go_standard_library:net\/http::::::::
golang	http2	Affected: 0 , < 0.23.0 (custom) cpe:2.3:a:golang:http2::::::::

Credits

Bartek Nowotarski (https://nowotarski.info/)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:17:43.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65051"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/576155"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2687"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240419-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/05/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/421644"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go_standard_library:net\\/http:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "net\\/http",
            "vendor": "go_standard_library",
            "versions": [
              {
                "lessThan": "1.21.9",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.22.2",
                "status": "affected",
                "version": "1.22.0-0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:golang:http2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "http2",
            "vendor": "golang",
            "versions": [
              {
                "lessThan": "0.23.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T17:08:42.212936Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T20:40:01.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "http2Framer.readMetaFrame"
            },
            {
              "name": "CanonicalHeaderKey"
            },
            {
              "name": "Client.CloseIdleConnections"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Cookie.String"
            },
            {
              "name": "Cookie.Valid"
            },
            {
              "name": "Dir.Open"
            },
            {
              "name": "Error"
            },
            {
              "name": "Get"
            },
            {
              "name": "HandlerFunc.ServeHTTP"
            },
            {
              "name": "Head"
            },
            {
              "name": "Header.Add"
            },
            {
              "name": "Header.Del"
            },
            {
              "name": "Header.Get"
            },
            {
              "name": "Header.Set"
            },
            {
              "name": "Header.Values"
            },
            {
              "name": "Header.Write"
            },
            {
              "name": "Header.WriteSubset"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "NewRequest"
            },
            {
              "name": "NewRequestWithContext"
            },
            {
              "name": "NotFound"
            },
            {
              "name": "ParseTime"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            },
            {
              "name": "ProxyFromEnvironment"
            },
            {
              "name": "ReadRequest"
            },
            {
              "name": "ReadResponse"
            },
            {
              "name": "Redirect"
            },
            {
              "name": "Request.AddCookie"
            },
            {
              "name": "Request.BasicAuth"
            },
            {
              "name": "Request.FormFile"
            },
            {
              "name": "Request.FormValue"
            },
            {
              "name": "Request.MultipartReader"
            },
            {
              "name": "Request.ParseForm"
            },
            {
              "name": "Request.ParseMultipartForm"
            },
            {
              "name": "Request.PostFormValue"
            },
            {
              "name": "Request.Referer"
            },
            {
              "name": "Request.SetBasicAuth"
            },
            {
              "name": "Request.UserAgent"
            },
            {
              "name": "Request.Write"
            },
            {
              "name": "Request.WriteProxy"
            },
            {
              "name": "Response.Cookies"
            },
            {
              "name": "Response.Location"
            },
            {
              "name": "Response.Write"
            },
            {
              "name": "ResponseController.EnableFullDuplex"
            },
            {
              "name": "ResponseController.Flush"
            },
            {
              "name": "ResponseController.Hijack"
            },
            {
              "name": "ResponseController.SetReadDeadline"
            },
            {
              "name": "ResponseController.SetWriteDeadline"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeContent"
            },
            {
              "name": "ServeFile"
            },
            {
              "name": "ServeMux.ServeHTTP"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.Close"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            },
            {
              "name": "Server.SetKeepAlivesEnabled"
            },
            {
              "name": "Server.Shutdown"
            },
            {
              "name": "SetCookie"
            },
            {
              "name": "Transport.CancelRequest"
            },
            {
              "name": "Transport.Clone"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "body.Close"
            },
            {
              "name": "body.Read"
            },
            {
              "name": "bodyEOFSignal.Close"
            },
            {
              "name": "bodyEOFSignal.Read"
            },
            {
              "name": "bodyLocked.Read"
            },
            {
              "name": "bufioFlushWriter.Write"
            },
            {
              "name": "cancelTimerBody.Close"
            },
            {
              "name": "cancelTimerBody.Read"
            },
            {
              "name": "checkConnErrorWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "connReader.Read"
            },
            {
              "name": "connectMethodKey.String"
            },
            {
              "name": "expectContinueReader.Close"
            },
            {
              "name": "expectContinueReader.Read"
            },
            {
              "name": "extraHeader.Write"
            },
            {
              "name": "fileHandler.ServeHTTP"
            },
            {
              "name": "fileTransport.RoundTrip"
            },
            {
              "name": "globalOptionsHandler.ServeHTTP"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "http2ClientConn.Close"
            },
            {
              "name": "http2ClientConn.Ping"
            },
            {
              "name": "http2ClientConn.RoundTrip"
            },
            {
              "name": "http2ClientConn.Shutdown"
            },
            {
              "name": "http2ConnectionError.Error"
            },
            {
              "name": "http2ErrCode.String"
            },
            {
              "name": "http2FrameHeader.String"
            },
            {
              "name": "http2FrameType.String"
            },
            {
              "name": "http2FrameWriteRequest.String"
            },
            {
              "name": "http2Framer.ReadFrame"
            },
            {
              "name": "http2Framer.WriteContinuation"
            },
            {
              "name": "http2Framer.WriteData"
            },
            {
              "name": "http2Framer.WriteDataPadded"
            },
            {
              "name": "http2Framer.WriteGoAway"
            },
            {
              "name": "http2Framer.WriteHeaders"
            },
            {
              "name": "http2Framer.WritePing"
            },
            {
              "name": "http2Framer.WritePriority"
            },
            {
              "name": "http2Framer.WritePushPromise"
            },
            {
              "name": "http2Framer.WriteRSTStream"
            },
            {
              "name": "http2Framer.WriteRawFrame"
            },
            {
              "name": "http2Framer.WriteSettings"
            },
            {
              "name": "http2Framer.WriteSettingsAck"
            },
            {
              "name": "http2Framer.WriteWindowUpdate"
            },
            {
              "name": "http2GoAwayError.Error"
            },
            {
              "name": "http2Server.ServeConn"
            },
            {
              "name": "http2Setting.String"
            },
            {
              "name": "http2SettingID.String"
            },
            {
              "name": "http2SettingsFrame.ForeachSetting"
            },
            {
              "name": "http2StreamError.Error"
            },
            {
              "name": "http2Transport.CloseIdleConnections"
            },
            {
              "name": "http2Transport.NewClientConn"
            },
            {
              "name": "http2Transport.RoundTrip"
            },
            {
              "name": "http2Transport.RoundTripOpt"
            },
            {
              "name": "http2bufferedWriter.Flush"
            },
            {
              "name": "http2bufferedWriter.Write"
            },
            {
              "name": "http2chunkWriter.Write"
            },
            {
              "name": "http2clientConnPool.GetClientConn"
            },
            {
              "name": "http2connError.Error"
            },
            {
              "name": "http2dataBuffer.Read"
            },
            {
              "name": "http2duplicatePseudoHeaderError.Error"
            },
            {
              "name": "http2gzipReader.Close"
            },
            {
              "name": "http2gzipReader.Read"
            },
            {
              "name": "http2headerFieldNameError.Error"
            },
            {
              "name": "http2headerFieldValueError.Error"
            },
            {
              "name": "http2noDialClientConnPool.GetClientConn"
            },
            {
              "name": "http2noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "http2pipe.Read"
            },
            {
              "name": "http2priorityWriteScheduler.CloseStream"
            },
            {
              "name": "http2priorityWriteScheduler.OpenStream"
            },
            {
              "name": "http2pseudoHeaderError.Error"
            },
            {
              "name": "http2requestBody.Close"
            },
            {
              "name": "http2requestBody.Read"
            },
            {
              "name": "http2responseWriter.Flush"
            },
            {
              "name": "http2responseWriter.FlushError"
            },
            {
              "name": "http2responseWriter.Push"
            },
            {
              "name": "http2responseWriter.SetReadDeadline"
            },
            {
              "name": "http2responseWriter.SetWriteDeadline"
            },
            {
              "name": "http2responseWriter.Write"
            },
            {
              "name": "http2responseWriter.WriteHeader"
            },
            {
              "name": "http2responseWriter.WriteString"
            },
            {
              "name": "http2roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "http2serverConn.CloseConn"
            },
            {
              "name": "http2serverConn.Flush"
            },
            {
              "name": "http2stickyErrWriter.Write"
            },
            {
              "name": "http2transportResponseBody.Close"
            },
            {
              "name": "http2transportResponseBody.Read"
            },
            {
              "name": "http2writeData.String"
            },
            {
              "name": "initALPNRequest.ServeHTTP"
            },
            {
              "name": "loggingConn.Close"
            },
            {
              "name": "loggingConn.Read"
            },
            {
              "name": "loggingConn.Write"
            },
            {
              "name": "maxBytesReader.Close"
            },
            {
              "name": "maxBytesReader.Read"
            },
            {
              "name": "onceCloseListener.Close"
            },
            {
              "name": "persistConn.Read"
            },
            {
              "name": "persistConnWriter.ReadFrom"
            },
            {
              "name": "persistConnWriter.Write"
            },
            {
              "name": "populateResponse.Write"
            },
            {
              "name": "populateResponse.WriteHeader"
            },
            {
              "name": "readTrackingBody.Close"
            },
            {
              "name": "readTrackingBody.Read"
            },
            {
              "name": "readWriteCloserBody.Read"
            },
            {
              "name": "redirectHandler.ServeHTTP"
            },
            {
              "name": "response.Flush"
            },
            {
              "name": "response.FlushError"
            },
            {
              "name": "response.Hijack"
            },
            {
              "name": "response.ReadFrom"
            },
            {
              "name": "response.Write"
            },
            {
              "name": "response.WriteHeader"
            },
            {
              "name": "response.WriteString"
            },
            {
              "name": "serverHandler.ServeHTTP"
            },
            {
              "name": "socksDialer.DialWithConn"
            },
            {
              "name": "socksUsernamePassword.Authenticate"
            },
            {
              "name": "stringWriter.WriteString"
            },
            {
              "name": "timeoutHandler.ServeHTTP"
            },
            {
              "name": "timeoutWriter.Write"
            },
            {
              "name": "timeoutWriter.WriteHeader"
            },
            {
              "name": "transportReadFromServerError.Error"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.2",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "Framer.readMetaFrame"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.Ping"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "ClientConn.Shutdown"
            },
            {
              "name": "ConfigureServer"
            },
            {
              "name": "ConfigureTransport"
            },
            {
              "name": "ConfigureTransports"
            },
            {
              "name": "ConnectionError.Error"
            },
            {
              "name": "ErrCode.String"
            },
            {
              "name": "FrameHeader.String"
            },
            {
              "name": "FrameType.String"
            },
            {
              "name": "FrameWriteRequest.String"
            },
            {
              "name": "Framer.ReadFrame"
            },
            {
              "name": "Framer.WriteContinuation"
            },
            {
              "name": "Framer.WriteData"
            },
            {
              "name": "Framer.WriteDataPadded"
            },
            {
              "name": "Framer.WriteGoAway"
            },
            {
              "name": "Framer.WriteHeaders"
            },
            {
              "name": "Framer.WritePing"
            },
            {
              "name": "Framer.WritePriority"
            },
            {
              "name": "Framer.WritePushPromise"
            },
            {
              "name": "Framer.WriteRSTStream"
            },
            {
              "name": "Framer.WriteRawFrame"
            },
            {
              "name": "Framer.WriteSettings"
            },
            {
              "name": "Framer.WriteSettingsAck"
            },
            {
              "name": "Framer.WriteWindowUpdate"
            },
            {
              "name": "GoAwayError.Error"
            },
            {
              "name": "ReadFrameHeader"
            },
            {
              "name": "Server.ServeConn"
            },
            {
              "name": "Setting.String"
            },
            {
              "name": "SettingID.String"
            },
            {
              "name": "SettingsFrame.ForeachSetting"
            },
            {
              "name": "StreamError.Error"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Transport.RoundTripOpt"
            },
            {
              "name": "bufferedWriter.Flush"
            },
            {
              "name": "bufferedWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "clientConnPool.GetClientConn"
            },
            {
              "name": "connError.Error"
            },
            {
              "name": "dataBuffer.Read"
            },
            {
              "name": "duplicatePseudoHeaderError.Error"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "headerFieldNameError.Error"
            },
            {
              "name": "headerFieldValueError.Error"
            },
            {
              "name": "noDialClientConnPool.GetClientConn"
            },
            {
              "name": "noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "pipe.Read"
            },
            {
              "name": "priorityWriteScheduler.CloseStream"
            },
            {
              "name": "priorityWriteScheduler.OpenStream"
            },
            {
              "name": "pseudoHeaderError.Error"
            },
            {
              "name": "requestBody.Close"
            },
            {
              "name": "requestBody.Read"
            },
            {
              "name": "responseWriter.Flush"
            },
            {
              "name": "responseWriter.FlushError"
            },
            {
              "name": "responseWriter.Push"
            },
            {
              "name": "responseWriter.SetReadDeadline"
            },
            {
              "name": "responseWriter.SetWriteDeadline"
            },
            {
              "name": "responseWriter.Write"
            },
            {
              "name": "responseWriter.WriteHeader"
            },
            {
              "name": "responseWriter.WriteString"
            },
            {
              "name": "roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "serverConn.CloseConn"
            },
            {
              "name": "serverConn.Flush"
            },
            {
              "name": "stickyErrWriter.Write"
            },
            {
              "name": "transportResponseBody.Close"
            },
            {
              "name": "transportResponseBody.Read"
            },
            {
              "name": "writeData.String"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bartek Nowotarski (https://nowotarski.info/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:10:07.754Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65051"
        },
        {
          "url": "https://go.dev/cl/576155"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2687"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240419-0009/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/05/4"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"
        }
      ],
      "title": "HTTP/2 CONTINUATION flood in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45288",
    "datePublished": "2024-04-04T20:37:30.714Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-11-04T18:17:43.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHBA-2024:2646

CVE-2023-45288 (GCVE-0-2023-45288)

Tags

Sightings

Nomenclature