{"id":"ALPINE-CVE-2023-45288","details":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.","modified":"2026-11-03T06:32:59.394120369Z","published":"2024-04-04T21:15:16.113Z","upstream":["CVE-2023-45288"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2023-45288"}],"affected":[{"package":{"name":"forgejo","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/forgejo?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.10.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"forgejo","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/forgejo?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.10.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"forgejo","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/forgejo?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.10.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"forgejo","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/forgejo?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.10.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"go","ecosystem":"Alpine:v3.19","purl":"pkg:apk/alpine/go?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"go","ecosystem":"Alpine:v3.20","purl":"pkg:apk/alpine/go?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"go","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/go?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"go","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/go?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"go","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/go?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"go","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/go?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"rclone","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/rclone?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.67.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"rclone","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/rclone?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.67.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"rclone","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/rclone?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.67.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}},{"package":{"name":"rclone","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/rclone?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.67.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-45288.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}