Bug 2522795

Summary: coredns__release-4.14: coredns__release-4.14: golang.org/x/net v0.17.0 vulnerable to HTTP/2 CONTINUATION flood (CVE-2023-45288 / GO-2024-2687)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agarcial, akhatavk, aoconnor, aos-team-art-private, asdas, asegurap, dpaolell, gparvin, jbalunas, jburrell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhaigner, security-response-team, sghai, sidsharm, suppawar, tsze, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 19:07:35 UTC 
## golang.org/x/net v0.17.0 vulnerable to HTTP/2 CONTINUATION flood (CVE-2023-45288 / GO-2024-2687)

**CWEs:** CWE-400
**CVSS:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
**Component:** openshift-4.14-payload/coredns__release-4.14

### Description
The indirect dependency golang.org/x/net is pinned at v0.17.0. Versions prior to v0.23.0 allow an attacker to send an unbounded sequence of HTTP/2 CONTINUATION frames after a HEADERS frame, forcing the server to buffer and HPACK-decode arbitrary amounts of header data without ever completing the request. CoreDNS links x/net/http2 for its DNS-over-HTTPS server (core/dnsserver/server_https.go) and indirectly via grpc-go and client-go. While the default OpenShift dns-operator Corefile does not enable DoH, the vulnerable code is compiled into the shipped binary and any custom Corefile enabling the https:// block is exposed.

### Affected Locations
- `:`
- `:`

### Evidence
**go.mod:108 — affected by CVE-2023-45288; fixed in v0.23.0**
```go
golang.org/x/net v0.17.0 // indirect
```

### Attack Pattern
Network client with access to the CoreDNS DoH or gRPC port drives unbounded HPACK decoding, OOM-killing the dns-default pods.

---
*Source: Ex-Wing security assessment, finding FIND-002*