x/vulndb: potential Go vuln in std: CVE-2019-9512, CVE-2019-9514

[tatianab]

Description

net/http: Denial of Service vulnerabilities in the HTTP/2 implementation

net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. Servers will now close connections if the send queue accumulates too many control messages.

Affected Modules, Packages, Versions and Symbols

Module: std
Package: net/http
Versions:
  - Fixed: 1.11.13
  - Introduced: 1.12.0
  - Fixed: 1.12.8

Module: golang.org/x/net/http2
Versions:
  - Fixed: v0.0.0-20190813141303-74dc4d7220e7

Does this vulnerability already have an associated CVE ID?

Yes

CVE ID

CVE-2019-9512, CVE-2019-9514

Credit

Jonathan Looney from Netflix

CWE ID

No response

Pull Request

https://go-review.googlesource.com/c/go/+/190137

Commit

https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5

References

• golang.org/issue/33606
• https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ

Additional information

No response

[gopherbot]

Change https://go.dev/cl/420656 mentions this issue: x/vulndb: add reports/GO-2022-0536.yaml for CVE-2019-9512, CVE-2019-9514

[tatianab]

Review for appropriate use of alias vs related