VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 4, 2024· Updated Apr 15, 2026

CVE-2023-45288

CVE-2023-45288

Description

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

HTTP/2 CONTINUATION flood vulnerability allows an attacker to cause denial of service by sending excessive CONTINUATION frames, consuming server resources.

Description CVE-2023-45288 is an HTTP/2 vulnerability in which an attacker can send an excessive number of CONTINUATION frames without setting the END_HEADERS flag. The server must parse and process all HEADERS and CONTINUATION frames to maintain HPACK compression state, even when the cumulative headers exceed the configured MaxHeaderBytes limit. This means the server decodes arbitrary amounts of header data that will ultimately be rejected, decoding Huffman-encoded data that is computationally expensive relative to the attacker's effort[1][4].

Exploitation The attacker only needs network connectivity to the target server; no authentication or special privileges are required. By initiating a single HTTP/2 connection and sending a stream of CONTINUATION frames, the attacker forces the server to continuously decode header data. The attack does not appear in HTTP access logs because the requests are never completed[1][2]. The lack of a limit on the number of CONTINUATION frames processed before closing the connection allows the attacker to sustain the attack indefinitely.

Impact Successful exploitation leads to denial of service via CPU exhaustion or memory exhaustion (OOM), as the server spends significant resources parsing and decoding headers that are never used. This can disrupt server availability with a single connection or a small number of frames[1][4].

Mitigation The fix introduces a limit on the number of excess header frames processed before the connection is closed. Patches are available from the Go project and other affected implementations[3][4]. Administrators should update their HTTP/2 libraries or apply vendor-specific workarounds.

References
  1. HTTP/2 `CONTINUATION` Flood: Technical Details
  2. security - CERT/CC VU#421644: HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  3. NVD - CVE-2023-45288
  4. CERT/CC Vulnerability Note VU#421644

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
net/httpGo
< 1.21.91.21.9
golang.org/x/net/http2Go
< 0.23.00.23.0
net/httpGo
>= 1.22.0-0, < 1.22.21.22.2
golang.org/x/netGo
< 0.23.00.23.0

Affected products

2628

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.