VYPR
← All advisories
High severityNVD Advisory· Published Oct 11, 2023· Updated Feb 13, 2025

HTTP/2 rapid reset can cause excessive work in net/http

CVE-2023-39325

Description

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A malicious HTTP/2 client can cause excessive server resource consumption by rapidly creating and resetting requests, bypassing stream concurrency limits.

Vulnerability

CVE-2023-39325 is a denial-of-service vulnerability in Go's HTTP/2 implementation. The root cause is that the http2.Server.MaxConcurrentStreams setting limits the number of concurrent streams, but resetting a stream allows a new stream to be created while the handler goroutine for the reset stream is still executing. This leads to a situation where the number of handler goroutines can exceed the configured stream limit, causing excessive resource consumption [1][2][3][4].

Exploitation

An attacker can exploit this by acting as an HTTP/2 client that rapidly opens streams and immediately resets them. The server continues to execute handlers for the reset streams and spawns new handlers for each new stream, eventually overwhelming the server's CPU and memory. No authentication is required; the attacker only needs network access to the server [1][2].

Impact

Successful exploitation results in excessive server resource consumption, potentially leading to a denial of service. The server may become unresponsive or crash under the load [1][2].

Mitigation

This vulnerability is fixed in Go 1.21.3, Go 1.20.10, and the golang.org/x/net/http2 package version 0.17.0. The default stream concurrency limit is 250 streams per connection, but this can be adjusted via the Server.MaxConcurrentStreams setting or the ConfigureServer function. The issue is also tracked as CVE-2023-44487, which affects other HTTP/2 implementations [2][4].

References
  1. NVD - CVE-2023-39325
  2. [security] Go 1.21.3 and Go 1.20.10 are released
  3. GO-2023-2102 - Go Packages
  4. net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325)

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/netGo
< 0.17.00.17.0

Affected products

1195

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

84

News mentions

0

No linked articles in our index yet.