Actions
Security #6892
closedhttp2: oom on copying compressed headers
Git IDs:
390f09692eb99809c679d3f350c7cc185d163e1a
Severity:
CRITICAL
Disclosure Date:
06/20/2024
Description
Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67562
I would rate this critical : can allocate up to 4Gbytes of memory with 128 kbytes of traffic...
We have one bound of 65k for the maximum "dynamic headers table" size, but this can get multiplied by an arbitrary number of bytes representing one compressed header.
Not sure to backport it for 6 as HTTP2 is experimental there
Updated by Philippe Antoine 3 months ago
- Private changed from No to Yes
- Label Needs backport to 7.0 added
Updated by Victor Julien 3 months ago
- Severity changed from MODERATE to CRITICAL
Updated by Philippe Antoine 3 months ago
- Related to Security #6900: http2: timeout logging headers added
Updated by Victor Julien 2 months ago
- Status changed from In Review to Closed
- Git IDs updated (diff)
Updated by Victor Julien about 2 months ago
- Private changed from Yes to No
Actions