## golang.org/x/net v0.17.0 — HTTP/2 CONTINUATION-flood DoS (CVE-2023-45288) reachable via DoH listener

**CWEs:** CWE-1333, CWE-400
**CVSS:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
**Component:** openshift-4.16-payload/coredns__release-4.16

### Description
The module pins golang.org/x/net at v0.17.0, which is vulnerable to CVE-2023-45288 (GO-2024-2687): an attacker can send an unbounded stream of HTTP/2 CONTINUATION frames forcing the server to decode HPACK headers indefinitely, exhausting CPU. CoreDNS's DoH server (ServerHTTPS) constructs an http.Server with NextProtos h2 enabled, so any cluster that enables the https:// transport block in the Corefile exposes this code path on the pod network. Fixed in golang.org/x/net v0.23.0.

### Affected Locations
- `:`
- `:`

### Evidence
**go.mod:120**
```go
golang.org/x/net v0.17.0 // indirect
```

**core/dnsserver/server_https.go:62-82 — h2 explicitly negotiated**
```go
if tlsConfig != nil {
    tlsConfig.NextProtos = []string{"h2", "http/1.1"}
}

srv := &http.Server{
    ReadTimeout:  s.readTimeout,
    WriteTimeout: s.writeTimeout,
    IdleTimeout:  s.idleTimeout,
    ErrorLog:     stdlog.New(&loggerAdapter{}, "", 0),
}
```

### Attack Pattern
Pod-network or external client with reach to the DoH port → unauthenticated CPU-exhaustion DoS of the cluster DNS pod.

---
*Source: Ex-Wing security assessment, finding FIND-001*