CVE-2023-45288
HighCVSS 7.5Summary
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection; when a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, including Huffman-encoded data that is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames processed before closing a connection.
Risk Assessment
An attacker can cause a denial of service (DoS) attack by exhausting CPU and memory resources of an HTTP/2 server. The risk affects all services exposed to untrusted HTTP/2 clients.
Recommendation
Update HTTP/2 server software (e.g., Go libraries, HTTP/2-capable servers) to a version containing the fix. Consider limiting the maximum header size and the number of CONTINUATION frames per connection.
Other vulnerabilities in HTTP/2
See all- CVE-2026-49160High
Uncontrolled resource consumption in HTTP/2 allows an unauthenticated attacker to perform a denial-of-service (DoS) attack over the network.
- CVE-2026-49788High
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS