GO-2022-0322
Uncontrolled resource consumption in github.com/prometheus/client_golang
At a glance
- Published
- Updated
- CVE
- CVE-2022-21698
- Aliases
- GHSA-cg3q-j54f-5p7p
Description
The Prometheus client_golang HTTP server is vulnerable to a denial of service attack when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of the promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass a metric with a "method" label name to a middleware; and not have any firewall/LB/proxy that filters away requests with unknown "method".
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/prometheus/client_golang | introduced 0, fixed 1.11.1 |
References
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |