Excessive memory allocation in net/http and net/textproto
Priority LOW 37CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 22 fixed, 27 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01888 79th percentileScored 2026-11-07
Fix Partial net/textproto (Go standard library): 1.19.8, 1.20.3Red Hat: 34 advisoriesRed Hat: 22 fixed, 27 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/textproto | before 1.19.8; 1.20.0-0 to before 1.20.3 | 1.19.8, 1.20.3 | Patch available | CNA |
- net/textproto VendorGo standard library Affected before 1.19.8; 1.20.0-0 to before 1.20.3 Fixed in 1.19.8, 1.20.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.19.8; 1.20.0 to before 1.20.3 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.19.8; 1.20.0 to before 1.20.3 Vulnerable ·Go standard library
Remediation
- Fix · CNA net/textproto (Go standard library) Fixed in 1.19.8, 1.20.3
Red Hat 34 advisories
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
- RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
- RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
Show 31 more Red Hat advisories
- RHSA-2023:6832 Released 2023-11-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.14.0 security, enhancement & bug fix update
- RHODF 4.14 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-cli-rhel9, odf4/mcg-core-rhel9 +12
- RHSA-2023:6346 Released 2023-11-07 · Red Hat rating Moderatetoolbox security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.4-6.el9_3, toolbox-tests-0.0.99.4-6.el9_3
- RHSA-2023:6402 Released 2023-11-07 · Red Hat rating Moderatecontainernetworking-plugins security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-4.el9
- RHSA-2023:6420 Released 2023-11-07 · Red Hat rating Moderategrafana security and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-7.el9_3
- RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderatepodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
- RHSA-2023:6473 Released 2023-11-07 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-1.el9, buildah-tests-1:1.31.3-1.el9
- RHSA-2023:6363 Released 2023-11-07 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-1.el9, skopeo-tests-2:1.13.3-1.el9
- RHSA-2023:5976 Released 2023-10-20 · Red Hat rating ImportantService Telemetry Framework 1.5.2 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/prometheus-webhook-snmp-rhel8, stf/service-telemetry-operator-bundle, stf/service-telemetry-rhel8-operator +4
- RHSA-2023:5964 Released 2023-10-20 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2.5 (collectd-libpod-stats) security update
- Red Hat OpenStack Platform 16.2 collectd-libpod-stats-1.0.4-5.el8ost
- RHSA-2023:4986 Released 2023-09-06 · Red Hat rating ModerateRed Hat OpenShift Distributed Tracing 2.9.0 security update
- Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
- RHSA-2023:4657 Released 2023-08-23 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.2 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:4664 Released 2023-08-16 · Red Hat rating ImportantOpenShift Virtualization 4.13.3 Images security and bug fix update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
- RHSA-2023:4459 Released 2023-08-08 · Red Hat rating ModerateOpenShift Container Platform 4.13.8 packages and security update
- Red Hat OpenShift Container Platform 4.13 cri-tools-1.26.0-3.el9
- RHSA-2023:4470 Released 2023-08-03 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
- RHSA-2023:4093 Released 2023-07-20 · Red Hat rating ImportantOpenShift Container Platform 4.13.5 security update
- Red Hat OpenShift Container Platform 4.13 openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, openshift-clients-4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 +5
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3943 Released 2023-06-29 · Red Hat rating ModerateACS 4.1 enhancement and security update
- RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
- RHSA-2023:3918 Released 2023-06-29 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-rhel8
- RHSA-2023:3612 Released 2023-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.13.4 packages and security update
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.18.1.el9_2, buildah-1:1.29.1-2.1.rhaos4.13.el9, buildah-1:1.29.1-2.rhaos4.13.el8 +47
- RHSA-2023:3624 Released 2023-06-15 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.10 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-velero-plugin-rhel8
- RHSA-2023:3540 Released 2023-06-13 · Red Hat rating ModerateOpenShift Container Platform 4.13.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 microshift-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9, microshift-networking-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9, microshift-release-info-4.13.3-202306081201.p0.g16708cc.assembly.4.13.3.el9 +1
- RHSA-2023:3536 Released 2023-06-13 · Red Hat rating ImportantOpenShift Container Platform 4.13.3 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 python-flask-2:2.0.1-4.el9.2, python-flask-doc-2:2.0.1-4.el9.2, python3-flask-2:2.0.1-4.el9.2
- Red Hat OpenShift Container Platform 4.13 NetworkManager-1:1.42.2-2.el9_2, NetworkManager-adsl-1:1.42.2-2.el9_2, NetworkManager-bluetooth-1:1.42.2-2.el9_2 +28
- RHSA-2023:3366 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.2 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-api-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-common-1:21.3.1-0.20230510075528.b3c902e.el9 +3
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.16.1.el9_2, buildah-1:1.29.1-1.1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.1.rhaos4.13.el9 +47
- RHSA-2023:3367 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:3455 Released 2023-06-05 · Red Hat rating ModerateRelease of OpenShift Serverless 1.29.0
- Red Hat OpenShift Serverless 1.29 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:3445 Released 2023-06-05 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-14.el8ost
- RHSA-2023:3450 Released 2023-06-05 · Red Hat rating ModerateOpenShift Serverless Client kn 1.29.0 release
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.8.1-3.el8
- RHSA-2023:3319 Released 2023-05-25 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.9-1.module+el8.8.0+18857+fca43658.aarch64::go-toolset:rhel8 +18
- RHSA-2023:3318 Released 2023-05-25 · Red Hat rating Importantgo-toolset and golang security update
- Red Hat Enterprise Linux AppStream (v. 9) golang-1.19.9-2.el9_2, golang-bin-1.19.9-2.el9_2, golang-docs-1.19.9-2.el9_2 +4
- RHSA-2023:3167 Released 2023-05-18 · Red Hat rating ModerateRed Hat build of Cryostat 2.3.0: new RHEL 8 container images
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library net/textproto 1.19.8, 1.20.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-10157 Excessive resource consumption in net/http, net/textproto and mime/multipartPriority LOW 36
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix planned: Out of support scope |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.4 | Fixed | — |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:3918 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:3624 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:4664 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2023:3167 |
| Ironic content for Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:3366 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:4657 |
| Quay v3 | Fixed | — |
| RHACS 4.1 for RHEL 8 | Fixed | RHSA-2023:3943 |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2023:6832 |
| Red Hat Ansible Automation Platform 2.3 for RHEL 8 | Fixed | RHSA-2023:4470 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:3319, RHSA-2023:6938, RHSA-2023:6939 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:3318, RHSA-2023:6346, RHSA-2023:6363, RHSA-2023:6402, RHSA-2023:6420, RHSA-2023:6473, RHSA-2023:6474 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:3366, RHSA-2023:3367, RHSA-2023:3536, RHSA-2023:3540, RHSA-2023:3612, RHSA-2023:4093, RHSA-2023:4459 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:3450 |
| Red Hat OpenShift Serverless 1.29 | Fixed | RHSA-2023:3455 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:3445, RHSA-2023:5964 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:5976 |
Not affected: 22 products
- 8Base-MTV-2.4
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.13 for RHEL 9
- Custom Metric Autoscaler operator for Red Hat Openshift
- Ironic content for Red Hat OpenShift Container Platform 4.13
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- Middleware Containers for OpenShift
- OSSO 1.1 for RHEL 8
- RHACS 4.1 for RHEL 8
- RHODF 4.14 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24534
- 2026-10-03 Alias added: GHSA-8v5j-pwr7-w5f8
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-24534 · CVE Program
- CVE-2023-24534 · NVD
- FIRST EPSS
- GHSA-8v5j-pwr7-w5f8 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-24534 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences