5.3

CVE-2023-39326: Denial of service via chunk extensions in net/http

Modified
AliasesRHSA-2024:1149RHSA-2024:1244UBUNTU-CVE-2023-39326
Published 06-12-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-39326 is a medium (CVSS 5.3) vulnerability in go standard library net/http/internal. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
1.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 116
MGASA-2023-0349OPENSUSE-SU-2024:13491-1OPENSUSE-SU-2024:13492-1RHSA-2023:7200RHSA-2023:7201RHSA-2024:0748

Showing 100 of 117.

Timeline

  1. 06-12-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.21%

Chance of exploitation in the next 30 days

Percentile

68%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard80 products
  • aactl< 0.4.12-r5
  • amass< 4.2.0-r3
  • aws-flb-cloudwatch< 1.9.4-r6
  • aws-flb-firehose< 1.7.2-r6
  • aws-flb-kinesis< 1.10.2-r6
Wolfi59 products
  • aactl< 0.4.12-r5
  • amass< 4.2.0-r3
  • aws-flb-cloudwatch< 1.9.4-r6
  • aws-flb-firehose< 1.7.2-r6
  • aws-flb-kinesis< 1.10.2-r6
Redhat5 products
  • rhc-worker-script< 0:0.6-1.el7_9
  • skopeo< 2:1.13.3-4.el9_3
  • skopeo-debuginfo< 2:1.13.3-4.el9_3
  • skopeo-debugsource< 2:1.13.3-4.el9_3
  • skopeo-tests< 2:1.13.3-4.el9_3
Ubuntu2 products
  • golang-1.20< 1.20.3-1ubuntu0.1~20.04.1 | < 1.20.3-1ubuntu0.1~22.04.1
  • golang-1.21< 1.21.1-1~ubuntu20.04.2 | < 1.21.1-1~ubuntu22.04.2
Alpine1 product
  • go≥ 1.21.0-0, < 1.21.5-r0
Debian1 product
  • golang-1.19All versions (No fix recorded)
Go1 product
  • stdlib≥ 1.21.0-0, < 1.21.5
Go standard library1 product
Golang1 product
  • go< 1.20.12 | ≥ 1.21.0-0, < 1.21.5

9 vendors · 151 products

References

20 links
Show all 20 references