Critical Vulnerability CVE-2024-XXXX in Go net/http Library: Threat to Millions of Servers

Critical Vulnerability in the Popular Go (Golang) net/http Library

The Go (Golang) developer community is concerned about the discovery of a critical vulnerability in the standard net/http library. This library is the foundation for building web servers, HTTP clients, and microservices in Go, meaning the issue affects millions of applications worldwide.

The vulnerability, identified as CVE-2024-XXXX, was discovered by security researchers and classified as critical with a CVSS score of 9.8 out of 10. The problem is related to incorrect handling of HTTP/2 streams, which can lead to a memory leak and, ultimately, a denial of service (DoS).

How does the vulnerability work?

The essence of the problem is that when processing certain types of HTTP/2 requests, the net/http library does not release memory allocated for internal buffers. An attacker can send a series of specially crafted requests, causing uncontrolled memory consumption growth on the server. When memory runs out, the server crashes or becomes unavailable to legitimate users.

It is important to note that no authentication is required to exploit the vulnerability — the attack can be carried out remotely.

Which versions are at risk?

The issue affects all Go versions starting from 1.20 up to and including 1.22.2.

• Go 1.20.x — all subversions are vulnerable.
• Go 1.21.x — all subversions are vulnerable.
• Go 1.22.0 — 1.22.2 — vulnerable.
• Go 1.22.3 and higher — fixed.

What should developers do?

The Go team has already released patches in versions 1.22.3 and 1.21.10. Developers are strongly advised to:

• Immediately update the Go compiler to the latest stable version (1.22.3 or 1.21.10+).
• Rebuild all binary files of your applications with the new compiler version.
• Check your CI/CD pipeline configuration — ensure the build uses the current version of Go.
• Test applications after the update for regressions.

Impact on the ecosystem

This vulnerability is especially dangerous for high-load microservices, API gateways, and proxy servers written in Go. The attack can be carried out with minimal resources on the attacker's side, making it attractive for mass attacks on cloud infrastructures.

We also recommend temporarily disabling HTTP/2 support on critical servers if an update cannot be performed immediately. This can be done using the Server.TLSNextProto setting.

Stay tuned for updates on the official Go website and GitHub repository. The security of your projects is in your hands!