Search for vulnerabilities
Vulnerability details: VCID-drkd-6ygy-aaaj
Vulnerability ID VCID-drkd-6ygy-aaaj
Aliases CVE-2023-24534
Summary HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-400 Uncontrolled Resource Consumption
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24534.json
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00301 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00349 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00349 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00349 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00349 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00349 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00408 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00408 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00408 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00408 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00408 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.00408 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.01863 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
epss 0.04681 https://api.first.org/data/v1/epss?cve=CVE-2023-24534
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://go.dev/cl/481994
cvssv3.1 7.5 https://go.dev/cl/481994
ssvc Track https://go.dev/cl/481994
ssvc Track https://go.dev/cl/481994
cvssv3.1 7.5 https://go.dev/issue/58975
cvssv3.1 7.5 https://go.dev/issue/58975
ssvc Track https://go.dev/issue/58975
ssvc Track https://go.dev/issue/58975
ssvc Track https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
ssvc Track https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-24534
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-24534
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2023-1704
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2023-1704
ssvc Track https://pkg.go.dev/vuln/GO-2023-1704
ssvc Track https://pkg.go.dev/vuln/GO-2023-1704
ssvc Track https://security.gentoo.org/glsa/202311-09
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20230526-0007/
ssvc Track https://security.netapp.com/advisory/ntap-20230526-0007/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24534.json
https://api.first.org/data/v1/epss?cve=CVE-2023-24534
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://go.dev/cl/481994
https://go.dev/issue/58975
https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
https://pkg.go.dev/vuln/GO-2023-1704
https://security.netapp.com/advisory/ntap-20230526-0007/
2184483 https://bugzilla.redhat.com/show_bug.cgi?id=2184483
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
CVE-2023-24534 https://nvd.nist.gov/vuln/detail/CVE-2023-24534
GLSA-202311-09 https://security.gentoo.org/glsa/202311-09
RHSA-2023:3167 https://access.redhat.com/errata/RHSA-2023:3167
RHSA-2023:3318 https://access.redhat.com/errata/RHSA-2023:3318
RHSA-2023:3319 https://access.redhat.com/errata/RHSA-2023:3319
RHSA-2023:3366 https://access.redhat.com/errata/RHSA-2023:3366
RHSA-2023:3367 https://access.redhat.com/errata/RHSA-2023:3367
RHSA-2023:3445 https://access.redhat.com/errata/RHSA-2023:3445
RHSA-2023:3450 https://access.redhat.com/errata/RHSA-2023:3450
RHSA-2023:3455 https://access.redhat.com/errata/RHSA-2023:3455
RHSA-2023:3536 https://access.redhat.com/errata/RHSA-2023:3536
RHSA-2023:3540 https://access.redhat.com/errata/RHSA-2023:3540
RHSA-2023:3612 https://access.redhat.com/errata/RHSA-2023:3612
RHSA-2023:3624 https://access.redhat.com/errata/RHSA-2023:3624
RHSA-2023:3918 https://access.redhat.com/errata/RHSA-2023:3918
RHSA-2023:3943 https://access.redhat.com/errata/RHSA-2023:3943
RHSA-2023:4003 https://access.redhat.com/errata/RHSA-2023:4003
RHSA-2023:4093 https://access.redhat.com/errata/RHSA-2023:4093
RHSA-2023:4335 https://access.redhat.com/errata/RHSA-2023:4335
RHSA-2023:4459 https://access.redhat.com/errata/RHSA-2023:4459
RHSA-2023:4470 https://access.redhat.com/errata/RHSA-2023:4470
RHSA-2023:4627 https://access.redhat.com/errata/RHSA-2023:4627
RHSA-2023:4657 https://access.redhat.com/errata/RHSA-2023:4657
RHSA-2023:4664 https://access.redhat.com/errata/RHSA-2023:4664
RHSA-2023:4986 https://access.redhat.com/errata/RHSA-2023:4986
RHSA-2023:5964 https://access.redhat.com/errata/RHSA-2023:5964
RHSA-2023:5976 https://access.redhat.com/errata/RHSA-2023:5976
RHSA-2023:6346 https://access.redhat.com/errata/RHSA-2023:6346
RHSA-2023:6363 https://access.redhat.com/errata/RHSA-2023:6363
RHSA-2023:6402 https://access.redhat.com/errata/RHSA-2023:6402
RHSA-2023:6420 https://access.redhat.com/errata/RHSA-2023:6420
RHSA-2023:6473 https://access.redhat.com/errata/RHSA-2023:6473
RHSA-2023:6474 https://access.redhat.com/errata/RHSA-2023:6474
RHSA-2023:6832 https://access.redhat.com/errata/RHSA-2023:6832
RHSA-2023:6938 https://access.redhat.com/errata/RHSA-2023:6938
RHSA-2023:6939 https://access.redhat.com/errata/RHSA-2023:6939
RHSA-2024:2944 https://access.redhat.com/errata/RHSA-2024:2944
USN-6038-1 https://usn.ubuntu.com/6038-1/
USN-6038-2 https://usn.ubuntu.com/6038-2/
USN-6140-1 https://usn.ubuntu.com/6140-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24534.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/cl/481994
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/cl/481994
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://go.dev/cl/481994
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://go.dev/cl/481994
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/issue/58975
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/issue/58975
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://go.dev/issue/58975
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://go.dev/issue/58975
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-24534
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-24534
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/vuln/GO-2023-1704
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/vuln/GO-2023-1704
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://pkg.go.dev/vuln/GO-2023-1704
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://pkg.go.dev/vuln/GO-2023-1704
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://security.gentoo.org/glsa/202311-09
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20230526-0007/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T17:14:51Z/ Found at https://security.netapp.com/advisory/ntap-20230526-0007/
Exploit Prediction Scoring System (EPSS)
Percentile 0.06858
EPSS Score 0.0003
Published At April 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.