Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

The vulnerability is a request smuggling flaw in Go's net/http2 library, specifically in the h2c handler when used with MaxBytesHandler. According to the official description [1], when MaxBytesHandler is employed, the body of an HTTP request is not fully consumed. This leaves residual data in the connection buffer.

An attacker can exploit this by sending a crafted HTTP/1.1 request with a body that, when not fully read, is interpreted as HTTP/2 frames by the server. The server, expecting HTTP/2 frames on the connection, reads the leftover body data, which the attacker can manipulate to represent arbitrary HTTP/2 requests [2]. This attack requires the server to be configured to upgrade from HTTP/1.1 to HTTP/2 via h2c (HTTP/2 cleartext).

The impact is request smuggling, allowing an attacker to inject malicious HTTP/2 requests that may bypass security controls, access restricted resources, or perform actions on behalf of other users. Additionally, the Go issue [2] highlights that the mitigation using MaxBytesHandler is ineffective and can lead to a denial-of-service (DoS) vector due to unbounded memory consumption when reading the body.

The vulnerability is fixed in golang.org/x/net version 0.1.1-0.20221104162952-702349b0e862 and later [3]. Users should update their dependencies. There is no workaround other than upgrading.