- Description
- An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
- Source
- security@golang.org
- NVD status
- Deferred
CVSS 3.1
- Type
- Secondary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
SUSE released security fixes for CVE-2022-21698, CVE-2023-45288 and CVE-2025-22870 in Multi-Linux Manager components on SUSE Linux Enterprise 12 and HPC platforms on 3 June 2026, LinuxSecurity reported. https://t.co/jcR047O8vO
@threatcluster
4 Jun 2026
74 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Urgent Security Update for #Ubuntu Users 🚨 A new critical patch addresses high-severity vulnerabilities (CVE-2023-45288, CVE-2023-45289) in Protocol Buffers (protobuf). Read more: 👉 https://t.co/OpA8fBVRvv #Security https://t.co/avewxdfoWb
@Cezar_H_Linux
4 Sept 2025
60 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes