| Package | Affected versions | Patched versions |
|---|---|---|
| golang.org/x/net | < 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 |
| stdlib | ≥ 1.12.0-0, < 1.12.8< 1.11.13 | 1.12.81.11.13 |
| traffic server | ≥ 6.0.0, ≤ 6.2.3≥ 7.0.0, ≤ 7.1.6≥ 8.0.0, ≤ 8.0.3 | |
| swiftnio | ≥ 1.0.0, ≤ 1.4.0 | |
| node.js | ≥ 10.0.0, ≤ 10.12.0≥ 10.13.0, < 10.16.3≥ 12.0.0, < 12.8.1≥ 8.0.0, ≤ 8.8.1≥ 8.9.0, < 8.16.1 | 10.16.312.8.18.16.1 |
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
golang.org/x/net/http2
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free