Actions
Security #6892
closedhttp2: oom on copying compressed headers
Git IDs:
390f09692eb99809c679d3f350c7cc185d163e1a
Severity:
CRITICAL
Disclosure Date:
06/20/2024
Description
Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67562
I would rate this critical : can allocate up to 4Gbytes of memory with 128 kbytes of traffic...
We have one bound of 65k for the maximum "dynamic headers table" size, but this can get multiplied by an arbitrary number of bytes representing one compressed header.
Not sure to backport it for 6 as HTTP2 is experimental there
Updated by OISF Ticketbot about 1 year ago
- Label deleted (
Needs backport to 7.0)
Updated by Philippe Antoine about 1 year ago
- Private changed from No to Yes
- Label Needs backport to 7.0 added
Updated by OISF Ticketbot about 1 year ago
- Label deleted (
Needs backport to 7.0)
Updated by Victor Julien about 1 year ago
- Severity changed from MODERATE to CRITICAL
Updated by Philippe Antoine about 1 year ago
- Related to Security #6900: http2: timeout logging headers added
Updated by Victor Julien 11 months ago
- Status changed from In Review to Closed
- Git IDs updated (diff)
Updated by Victor Julien 11 months ago
- Private changed from Yes to No
Actions