CVE-2023-39326

Aliases:GO-2023-2382BIT-golang-2023-39326RHSA-2024:1149RHSA-2024:1244DEBIAN-CVE-2023-39326CGA-2432-ghhp-mgw2CGA-2486-jg73-fxqvCGA-25gh-q7j6-3jhcCGA-25xg-p4j9-7jh4CGA-29cc-29g9-3268CGA-2f2c-79r4-945fCGA-2f39-xrqh-f8x3CGA-2m49-45qm-jx6xCGA-2mxc-f9v8-qcg5CGA-2wq7-w86w-rj63CGA-3233-q5w5-8pm5CGA-335p-pqp7-vjm3CGA-36j5-7m5h-62mcCGA-38jv-w5gc-7h8hCGA-39pm-h7r4-fgh9CGA-3cj6-4rqh-p88fCGA-3mjf-j7xr-626fCGA-42g4-v25m-p2rjCGA-45g3-78j6-54jpCGA-47hx-4cr5-wfqwCGA-488x-37cf-j9xpCGA-49gg-5vf9-g9vgCGA-4v2w-6mr3-7568CGA-4wqr-p28r-r3wpCGA-52xg-44h7-cx9vCGA-5662-p6xf-mgj8CGA-5887-q4cf-v7x9CGA-5c38-5xj6-j72gCGA-5jh9-vf2p-hrcxCGA-5jmf-vpc5-f37jCGA-5qvm-9x94-r2xpCGA-5v7g-8p49-62q8CGA-5wwg-jq9j-26fjCGA-5xqg-48q8-qw6rCGA-63qr-hfff-5jffCGA-65rh-fw68-j2pcCGA-676x-m7p8-ghx2CGA-67g2-xjg4-52v7CGA-6xg4-h4c9-572fCGA-6xx4-q3g2-qwvhCGA-736g-25pf-xf5gCGA-7f45-vqvr-2gfrCGA-7p4h-663c-357gCGA-7x53-rf7w-jq8pCGA-7xg2-rpwv-4c9mCGA-83r2-r9xp-7j9xCGA-8559-5j7q-656rCGA-863r-4r97-q4gcCGA-8956-r59p-p7qxCGA-89g7-72mh-r367CGA-8j7q-mjf4-9x4jCGA-8jmc-m35q-3mvgCGA-8pj8-pcqv-frc8CGA-8v3x-xq3j-f9gjCGA-922g-8cxr-jw2hCGA-922m-jvvw-66mwCGA-9449-hgxg-p656CGA-95j2-qxgj-wm9qCGA-9c2w-29xh-v3jgCGA-9h2w-p7xc-m3gqCGA-9p7p-299x-4x7cCGA-9pgc-gh6c-pph4CGA-c4j9-5p9g-f97hCGA-c8p3-c99q-7v39CGA-cfrq-29qx-4qv9CGA-ch27-hv94-7grjCGA-cph5-28c2-5c36CGA-cvjv-mgmx-cjj7CGA-f92r-47xr-g8r3CGA-fw76-3p92-924cCGA-gjfw-5pwh-fhqgCGA-h2x2-qvfq-4gw5CGA-h79r-jh74-ch94CGA-hvmw-4pqh-wmr9CGA-hw4h-h9cq-rhwwCGA-j2f6-fvjf-2w2pCGA-j485-gmhw-g7h8CGA-jgxj-35rj-pg96CGA-jpq7-h2fh-8m5vCGA-jq6x-54p5-hq2hCGA-jvpg-fgvv-5x89CGA-m6c6-mvg3-cpfmCGA-mmh3-h485-h9rfCGA-mp3j-5wr7-8mq2CGA-pf28-44g6-w538CGA-pfhr-qqmc-r6j4CGA-pfwf-h7mc-v834CGA-pq84-c2xx-49vhCGA-prmv-qrxp-h6vwCGA-pwrm-2r29-35m9CGA-2fxr-jh4g-j37vCGA-2q52-j7r2-fr4gCGA-4242-wfx7-33xgCGA-49m3-ww65-vcwxCGA-4cq4-f5j5-8w6rCGA-4v77-6p5g-2pfgCGA-4wq9-xh7c-4hf7CGA-4x2c-pqg9-3qh4CGA-4xq5-gjw5-5pwgCGA-52hj-p24q-4p85CGA-65wx-94pj-8rv5CGA-69q4-7xxx-wj2hCGA-7738-mm54-xg43CGA-78v3-5c8p-w983CGA-798x-m6rq-226rCGA-7v82-c864-vxghCGA-8fj3-q7r2-vqr5CGA-8xqw-r7pr-fcjxCGA-9fp8-9hj8-g95rCGA-9g2r-pmvf-6c54CGA-9h3x-qwx7-vwrwCGA-cjrw-fv8f-2hq2CGA-cqf8-qx42-qwrjCGA-crp7-48rr-gwpqCGA-fm8p-g2qx-6cq5CGA-fvj9-gp8p-3728CGA-g6pq-xqrg-whx8CGA-hvvj-fhmf-mvrgCGA-jr9w-689m-226pCGA-m2r6-6pm3-24gvCGA-mv98-jcjc-76mhCGA-prvf-mqq9-vrp8CGA-pvw5-37v7-c9v4CGA-q3w7-v2vp-9qrjCGA-q95r-qc8w-g3fmCGA-qcpp-7hx7-j692CGA-qjvg-fw37-qp29CGA-qqw5-vq33-mwqfCGA-qxmj-6v59-7659CGA-qxpr-473j-8f79CGA-qxv3-3pq9-h3wpCGA-r22x-6wgg-5586CGA-r3m7-4cj2-qcqwCGA-r7jx-7m34-cx5jCGA-r99v-q7w9-944qCGA-rh77-phpp-cfqcCGA-rj4g-hfq7-26mjCGA-rjrp-fc99-h43pCGA-rvxx-g4q9-7qpvCGA-v39h-xj2m-h4vvCGA-v689-rx3j-ch4mCGA-v8f8-cjc2-2wm6CGA-vf63-mmpv-7rv6CGA-vgpp-82vj-9233CGA-w352-hc2h-64x4CGA-w9m4-hgv4-c8f3CGA-wc69-23mp-c24hCGA-wc8f-6c28-wfc9CGA-wfr2-h8rf-2w85CGA-wgm3-5399-3fjrCGA-x6vf-c947-8c62CGA-x8j2-4rch-f778CGA-x9g7-957h-5v74CGA-xjmg-w6w2-9qhjCGA-xmph-pf36-h3hrCGA-xpcc-p47r-xv6jCGA-xqr2-r6pr-h9mcCGA-xwm5-cmph-j5p5CGA-hw9w-h53c-xr55CGA-wx4j-mjjv-cjc5
Advisory lineage Upstream: 0 Downstream: 30
Modified
Published: 06 Dec 2023, 16:27
Last modified:13 Feb 2025, 17:02

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
1.21% LOW
1% probability +1.14%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 Dec 2023, 16:27
Published
Vulnerability first disclosed
13 Feb 2025, 17:02
Last Modified
Vulnerability information updated

Description

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 1.21%• Percentile: 67%

Affected Systems

  • chainguard•aactl

    < 0.4.12-r5

  • chainguard•amass

    < 4.2.0-r3

  • chainguard•aws-flb-cloudwatch

    < 1.9.4-r6

  • chainguard•aws-flb-firehose

    < 1.7.2-r6

  • chainguard•aws-flb-kinesis

    < 1.10.2-r6

  • chainguard•bank-vaults-fips

    < 1.20.4-r3

  • chainguard•cass-operator

    < 1.18.2-r3

  • chainguard•cass-operator-fips

    < 1.18.2-r1

  • chainguard•cni-plugins

    < 1.4.0-r1

  • chainguard•cni-plugins-fips

    < 1.4.0-r1

  • chainguard•configmap-reload

    < 0.12.0-r3

  • chainguard•configmap-reload-fips

    < 0.12.0-r2

  • chainguard•configmap-reload-fips-0.11

    < 0.11.1-r3

  • chainguard•cortex

    < 1.16.0-r1

  • chainguard•ctop

    < 0.7.7-r10

  • chainguard•dgraph

    < 23.1.0-r4

  • chainguard•docker-cli

    < 24.0.6-r1

  • chainguard•docker-credential-ecr-login

    < 0.7.1-r8

  • chainguard•flannel-cni-plugin

    < 1.2.0-r5

  • chainguard•fulcio-fips

    < 1.4.3-r1

  • chainguard•gke-gcloud-auth-plugin

    < 0.0.2-r6

  • chainguard•go-bindata

    < 3.1.3-r15

  • chainguard•go-licenses

    < 1.6.0-r8

  • chainguard•go-md2man

    < 2.0.3-r1

  • chainguard•gobuster

    < 3.6.0-r4

  • chainguard•gops

    < 0.3.28-r4

  • chainguard•gosu

    < 1.17-r2

  • chainguard•grpcurl

    < 1.8.9-r2

  • chainguard•helm-push

    < 0.10.4-r1

  • chainguard•hey

    < 0.1.4-r9

  • chainguard•hubble-ui-backend

    < 0.13.3-r1

  • chainguard•influx

    < 2.7.3-r8

  • chainguard•ip-masq-agent

    < 2.9.3-r6

  • chainguard•jsonnet-bundler

    < 0.5.1-r1

  • chainguard•k3d

    < 5.6.0-r5

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    < 0.19.0-r40

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kind

    < 0.21.0-r0

  • chainguard•kube-logging-logging-operator-4.1

    < 4.1.0-r3

  • chainguard•kubernetes-csi-livenessprobe-2.10

    < 2.10.0-r4

  • chainguard•kubernetes-csi-livenessprobe-fips

    < 2.11.0-r4

  • chainguard•kubernetes-csi-livenessprobe-fips-2.10

    < 2.10.0-r4

Showing first 50 affected entries in server-rendered view.

References (15)