Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
InfluxDB may waste resources processing oversized HTTP/2 headers
published 2 years ago
Summary
InfluxDB versions before 2.7.3-6 can be tricked into handling extremely large numbers of HTTP/2 header frames, causing the server to spend time decoding data that will later be rejected. This can slow down the service and affect availability. Update InfluxDB to the latest version or apply the provided patch to limit the amount of header data processed.
What to do
- Update azure influxdb to version 2.7.3-6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | influxdb |
< 2.7.3-6 Fix: upgrade to 2.7.3-6
|
Original advisory text
CVE-2023-45288 affecting package influxdb for versions less than 2.7.3-6
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
References
Timeline
Published4 Apr 2024
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-38950 · OSV
Track software like this
Free during beta