9104583124
Fixes CVE-2023-39325: rapid stream resets can cause excessive work A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. go1.21.3 (released 2023-10-10) includes a security fix to the net/http package. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: Christian Stewart <christian@aperture.us> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> |
||
|---|---|---|
| .. | ||
| 0001-build.go-explicit-option-for-crosscompilation.patch | ||
| 0002-cmd-dist-set-buildvcs-false-when-building-go-bootstr.patch | ||
| Config.in.host | ||
| go.hash | ||
| go.mk | ||