Denial of service via chunk extensions in net/http
Priority LOW 26Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 31 fixed, 41 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
Why it matters now
EPSS 0.01208 68th percentileScored 2026-11-07
Fix Partial net/http/internal (Go standard library): 1.20.12, 1.21.5Red Hat: 38 advisoriesRed Hat: 31 fixed, 41 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http/internal | before 1.20.12; 1.21.0-0 to before 1.21.5 | 1.20.12, 1.21.5 | Patch available | CNA |
- net/http/internal VendorGo standard library Affected before 1.20.12; 1.21.0-0 to before 1.21.5 Fixed in 1.20.12, 1.21.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.20.12; 1.21.0-0 to before 1.21.5 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.20.12; 1.21.0-0 to before 1.21.5 Vulnerable ·Go standard library
Remediation
- Fix · CNA net/http/internal (Go standard library) Fixed in 1.20.12, 1.21.5
Red Hat 38 advisories
- RHSA-2024:3868 Released 2024-06-17 · Red Hat rating ImportantNetwork Observability 1.6.0 for OpenShift
- NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:3479 Released 2024-05-29 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 director Operator container images security update
- Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
- RHSA-2024:2728 Released 2024-05-29 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 director Operator container images security update
- Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-downloader, rhosp-rhel9/osp-director-operator +1
Show 35 more Red Hat advisories
- RHSA-2024:3467 Released 2024-05-29 · Red Hat rating ImportantRed Hat OpenStack Platform 16.1 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-16.el8ost
- RHSA-2024:3352 Released 2024-05-23 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-16.el8ost
- RHSA-2024:3316 Released 2024-05-23 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
- RHSA-2024:2730 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (collectd-sensubility) security update
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el9ost
- RHSA-2024:2729 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (etcd) security update
- Red Hat OpenStack Platform 17.1 etcd-3.4.26-8.el9ost
- RHSA-2024:2767 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (collectd-sensubility) security update
- Red Hat OpenStack Platform 17.1 collectd-sensubility-0.2.1-3.el8ost
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2193 Released 2024-04-30 · Red Hat rating Moderatepodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.9.4-0.1.el9, podman-docker-2:4.9.4-0.1.el9, podman-plugins-2:4.9.4-0.1.el9 +2
- RHSA-2024:2160 Released 2024-04-30 · Red Hat rating Moderatetoolbox security update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.5-2.el9, toolbox-tests-0.0.99.5-2.el9
- RHSA-2024:2245 Released 2024-04-30 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.6-2.el9, buildah-tests-2:1.33.6-2.el9
- RHSA-2024:2272 Released 2024-04-30 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.4.0-2.el9_4
- RHSA-2024:1896 Released 2024-04-25 · Red Hat rating ImportantOpenShift Container Platform 4.12.56 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:1901 Released 2024-04-18 · Red Hat rating ModerateRed Hat Service Interconnect 1.5.3 Release (images)
- Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-rhel9, service-interconnect/skupper-flow-collector-rhel9 +4
- RHSA-2024:1859 Released 2024-04-16 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-rhel9-operator, oadp/oadp-velero-plugin-for-csi-rhel9, oadp/oadp-velero-plugin-for-gcp-rhel9 +3
- RHSA-2024:1812 Released 2024-04-15 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-376 Bug Fixes
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
- RHSA-2024:1640 Released 2024-04-02 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.5-2.el8ap, python39-aiohttp-3.9.3-1.el8ap, python39-django-4.2.11-1.el8ap +4
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.5-2.el9ap, python-aiohttp-3.9.3-1.el9ap, python-django-4.2.11-1.el9ap +4
- RHSA-2024:1434 Released 2024-03-20 · Red Hat rating ModerateRed Hat OpenShift distributed tracing 3.1.1 operator/operand containers
- Red Hat OpenShift distributed tracing 3.1 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16
- RHSA-2024:1244 Released 2024-03-11 · Red Hat rating Moderaterhc-worker-script security update
- Red Hat Enterprise Linux Client (v. 7) rhc-worker-script-0.6-1.el7_9
- Red Hat Enterprise Linux Server (v. 7) rhc-worker-script-0.6-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) rhc-worker-script-0.6-1.el7_9
- RHSA-2024:0281 Released 2024-03-06 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.2.1 for RHEL 9
- OSSO 1.2 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
- RHSA-2024:1149 Released 2024-03-05 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-4.el9_3, skopeo-tests-2:1.13.3-4.el9_3
- RHSA-2024:1131 Released 2024-03-05 · Red Hat rating Moderategolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.20.12-1.el9_3, golang-1.20.12-1.el9_3, golang-bin-1.20.12-1.el9_3 +4
- RHSA-2024:1078 Released 2024-03-05 · Red Hat rating ModerateService Telemetry Framework 1.5.4 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2024:1041 Released 2024-02-29 · Red Hat rating Moderatego-toolset-1.19-golang security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.13-5.el7_9, go-toolset-1.19-golang-bin-1.19.13-5.el7_9, go-toolset-1.19-golang-docs-1.19.13-5.el7_9 +4
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.13-5.el7_9, go-toolset-1.19-golang-bin-1.19.13-5.el7_9, go-toolset-1.19-golang-docs-1.19.13-5.el7_9 +4
- RHSA-2024:0269 Released 2024-02-28 · Red Hat rating ModerateRun Once Duration Override Operator for Red Hat OpenShift 1.1.0 for RHEL 9
- RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2023:7200 Released 2024-02-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.z security update
- Red Hat OpenShift Container Platform 4.15 microshift-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9, microshift-greenboot-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9, microshift-networking-4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9 +3
- RHSA-2023:7201 Released 2024-02-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.0 packages and security update
- Red Hat OpenShift Container Platform 4.15 buildah-1:1.29.1-20.2.rhaos4.15.el8, buildah-1:1.29.1-20.2.rhaos4.15.el9, buildah-tests-1:1.29.1-20.2.rhaos4.15.el8 +37
- RHSA-2023:7198 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
- RHSA-2024:0887 Released 2024-02-20 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.20.2-1.module+el8.9.0+18926+5193682d.src::go-toolset:rhel8, delve-1.20.2-1.module+el8.9.0+18926+5193682d.x86_64::go-toolset:rhel8, go-toolset-1.20.12-1.module+el8.9.0+21033+5795bdf6.aarch64::go-toolset:rhel8 +17
- RHSA-2024:0880 Released 2024-02-20 · Red Hat rating CriticalRelease of OpenShift Serverless Client kn 1.31.1 security update
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.10.0-6.el8
- RHSA-2024:0843 Released 2024-02-15 · Red Hat rating CriticalRelease of OpenShift Serverless 1.31.1
- Red Hat OpenShift Serverless 1.31 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-swf-builder-rhel8 +37
- RHSA-2024:0748 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.s390x::container-tools:4.0 +47
- RHSA-2024:0728 Released 2024-02-08 · Red Hat rating ModerateLogging Subsystem 5.8.3 - Red Hat OpenShift
- RHOL 5.8 for RHEL 9 openshift-logging/logging-loki-rhel9
- RHSA-2024:0695 Released 2024-02-07 · Red Hat rating ModerateLogging 5.6.16 - Red Hat OpenShift
- RHOL 5.6 for RHEL 8 openshift-logging/logging-loki-rhel8
- RHSA-2024:0694 Released 2024-02-07 · Red Hat rating ModerateLogging Subsystem 5.7.11 - Red Hat OpenShift
- RHOL 5.7 for RHEL 8 openshift-logging/logging-loki-rhel8
- RHSA-2024:0530 Released 2024-01-25 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Builds for Red Hat OpenShift | Affected | No fix yet |
| Cost Management Metrics Operator | Affected | No fix yet |
| Fence Agents Remediation Operator | Affected | No fix yet |
| Logical Volume Manager Storage | Affected | No fix yet |
| Machine Deletion Remediation Operator | Affected | No fix yet |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Containers | Affected | No fix yet |
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| 8Base-MTV-2.5 | Fixed | — |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:1859 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2024:0530 |
| MTA 7.0 for RHEL 9 | Fixed | RHSA-2024:3316 |
| NETOBSERV 1.6 for RHEL 9 | Fixed | RHSA-2024:3868 |
| OSSO 1.2 for RHEL 9 | Fixed | RHSA-2024:0281 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2024:1812 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2024:0695 |
| RHOL 5.7 for RHEL 8 | Fixed | RHSA-2024:0694 |
| RHOL 5.8 for RHEL 9 | Fixed | RHSA-2024:0728 |
| RODOO 1.1 for RHEL 9 | Fixed | RHSA-2024:0269 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:1640 |
| Red Hat Ceph Storage 5.3 Tools | Fixed | — |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:1041 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:1041 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0748, RHSA-2024:0887, RHSA-2024:2988 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:1131, RHSA-2024:1149, RHSA-2024:2160, RHSA-2024:2193, RHSA-2024:2245, RHSA-2024:2272 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2024:1244 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:1244 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:1244 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:1896 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2023:7198, RHSA-2023:7200, RHSA-2023:7201 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2024:0880 |
| Red Hat OpenShift Serverless 1.31 | Fixed | RHSA-2024:0843 |
| Red Hat OpenShift distributed tracing 3.1 | Fixed | RHSA-2024:1434 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2024:3467 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:3352, RHSA-2024:3479 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:2728, RHSA-2024:2729, RHSA-2024:2730, RHSA-2024:2767 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2024:1901 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2024:1078 |
Not affected: 18 products
- 8Base-MTV-2.5
- 9Base-OADP-1.3
- Ironic content for Red Hat OpenShift Container Platform 4.15
- MTA 7.0 for RHEL 8
- MTA 7.0 for RHEL 9
- RHOL 5.6 for RHEL 8
- RHOL 5.7 for RHEL 8
- RHOL 5.8 for RHEL 9
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.15
- Red Hat Satellite 6
- Service Telemetry Framework 1.5 for RHEL 8
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39326
- 2026-10-03 Alias added: GHSA-9f76-wg39-x86h
- 2026-10-30 Fix available: Red Hat Ceph Storage 5.3 Tools · Red Hat
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-39326 · CVE Program
- CVE-2023-39326 · NVD
- FIRST EPSS
- GHSA-9f76-wg39-x86h · GitHub Advisory Database · CC BY 4.0
- CVE-2023-39326 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences