CVE-2019-9514: Allocation of Resources Without Limits or Throttling

May 24, 2022 (updated February 24, 2023)

Some HTTP/2 implementations is vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

References

github.com/advisories/GHSA-39qc-96h7-956f
go.dev/cl/190137
go.dev/issue/33606
go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
nvd.nist.gov/vuln/detail/CVE-2019-9514
pkg.go.dev/vuln/GO-2022-0536

Code Behaviors & Features

Detect and mitigate CVE-2019-9514 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →