CVE-2023-24534
CVE Details
Last Update
09/20/2024
NIST CVE Summary
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
Our Official Summary
This CVE involves excessive memory allocation in net/http and net/textproto, potentially leading to a denial-of-service due to large memory allocation while parsing HTTP and MIME headers even for small inputs. Attackers can exploit this vulnerability to exhaust an HTTP server's memory resources, causing a denial of service. By crafting specific input data patterns, an attacker can trigger the excessive memory allocation behavior in the HTTP and MIME header parsing functions, leading to memory exhaustion. The risk of this vulnerability exploited in Spectro Cloud products is very low. 3rd party images affected will be upgraded to remove the vulnerability.
CVE Severity
Status
Ongoing
Affected Products & Versions
- Palette VerteX 4.4.18
Revision History
- 1.0 09/15/2024 Initial Publication
- 2.0 09/15/2024 Added palette VerteX 4.4.18 to Affected Products