Skip to content
Fencer Vulns
medium 5.3

CVE-2023-39326 json

Denial of service via chunk extensions in net/http

published 2023-12-06 2 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-39326 , EUVD-2023-43057 , GO-2023-2382

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

Patch / fix

  • bitnami golang 1.20.12, 1.21.5
  • go stdlib 1.20.12, 1.21.5
  • Go standard library net/http/internal 1.20.12, 1.21.5
  • golang-1.20 Ubuntu 20.04 LTS 1.20.3-1ubuntu0.1~20.04.1
  • golang-1.20 Ubuntu 22.04 LTS 1.20.3-1ubuntu0.1~22.04.1
  • golang-1.21 Ubuntu 20.04 LTS 1.21.1-1~ubuntu20.04.2
  • golang-1.21 Ubuntu 22.04 LTS 1.21.1-1~ubuntu22.04.2

ubuntu advisories UBUNTU-CVE-2023-39326

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
  • runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
  • udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
  • podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
  • skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c

red hat advisories RHSA-2024:2988RHSA-2024:0887RHSA-2024:0748RHSA-2024:0880RHSA-2023:7201RHSA-2023:7200

  • go1.21-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.5.1-150000.1.8.1
  • go1.20-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.12.1-150000.1.17.1
  • go1.21 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.5-150000.1.18.1
  • go1.20 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.12-150000.1.35.1

suse advisories SUSE-SU-2023:4931-1SUSE-SU-2023:4930-1SUSE-SU-2023:4709-1SUSE-SU-2023:4708-1

  • go1.20 openSUSE Tumbleweed 1.20.12-1.1
  • go1.21 openSUSE Tumbleweed 1.21.5-1.1

opensuse advisories openSUSE-SU-2024:13491-1openSUSE-SU-2024:13492-1

  • toolbox AlmaLinux 9 0.0.99.5-2.el9
  • toolbox-tests AlmaLinux 9 0.0.99.5-2.el9
  • podman AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-tests AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-docker AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-remote AlmaLinux 9 2:4.9.4-0.1.el9
  • podman-plugins AlmaLinux 9 2:4.9.4-0.1.el9
  • buildah AlmaLinux 9 2:1.33.6-2.el9

almalinux advisories ALSA-2024:2160ALSA-2024:2193ALSA-2024:2245ALSA-2024:2272ALSA-2024:1131ALSA-2024:1149

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.12-1.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-1.module+el8.10.0+1825+623b0c20
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2024:0748RLSA-2024:2988

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.21.5-r0

alpine advisories ALPINE-CVE-2023-39326

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.21.5-1
  • msft-golang CBL-Mariner 2.0 1.21.5-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-32102AZL-32124AZL-37446AZL-37452

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-39326 updated cvss 5.3

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

  • Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel8 Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel8-operator Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel8-operator
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-registry-rhel8
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat NBDE Tang Server tang-operator-container
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift Developer Tools and Services odo, helm, ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator
    +1 more products
    Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 aap-cloud-ui-container
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
show 15 more
  • Red Hat Ceph Storage 7 rhceph/grafana-rhel9
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-cnf, redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, redhat-certification-preflight
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Enterprise Linux 7 podman, skopeo, buildah, containernetworking-plugins
    affected: workaround, no fix available, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Enterprise Linux 8 weldr-client, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Enterprise Linux 9 butane, ignition, weldr-client, ignition-edge, ignition-grub, osbuild-composer, +4 more
    affected: workaround, no fix available, no fix planned “No mitigation is available for this flaw.”
  • Red Hat OpenShift Container Platform 4 openshift-golang-builder-container Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 kubevirt
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat OpenStack Platform 16.2 golang-github-infrawatch-apputils
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat OpenStack Platform 18.0 etcd, rhoso-operators/ovn-rhel9-operator
    affected: workaround, no fix available, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Quay 3 quay/clair-rhel8
    affected: workaround, no fix available “No mitigation is available for this flaw.”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: workaround, no fix planned “No mitigation is available for this flaw.”
  • Red Hat Web Terminal web-terminal-exec-container
    affected: workaround, no fix available “No mitigation is available for this flaw.”

1 more affected, 31 more fixed, 18 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.20.12
>=1.21.0-0, <1.21.5
1.20.12
1.21.5
go stdlib
<1.20.12
>=1.21.0-0, <1.21.5
1.20.12
1.21.5

Affected products

  • Go standard library net/http/internal

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.