PT-2022-4597 · Unknown+8 · Client Golang+8
Bwplotka
·
Published
2022-02-15
·
Updated
2026-04-28
·
CVE-2022-21698
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
client golang versions prior to 1.11.1
Description
The HTTP server in client golang is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. To be affected, an instrumented software must use any of
promhttp.InstrumentHandler* middleware except RequestsInFlight, not filter any specific methods before middleware, pass metric with method label name to the middleware, and not have any firewall/LB/proxy that filters away requests with unknown method.Recommendations
For client golang versions prior to 1.11.1, update to version 1.11.1 or later to resolve the issue.
As a temporary workaround, consider removing the
method label name from counter/gauge used in the InstrumentHandler.
Alternatively, turn off affected promhttp handlers or add custom middleware before promhttp handler that will sanitize the request method given by Go http.Request.
Using a reverse proxy or web application firewall, configured to only allow a limited set of methods, can also help mitigate the issue.Exploit
Fix
DoS
Missing Release of Resource after Effective Lifetime
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Debian
Red Hat
Red Os
Rocky Linux
Suse
Client Golang