CVE-2021-31525: 
Go vulnerability analysis and mitigation

A vulnerability was discovered in the Go programming language's net/http package affecting versions before 1.15.12 and 1.16.x before 1.16.4. The vulnerability, identified as CVE-2021-31525, was discovered by Guido Vranken as part of the Ethereum 2.0 bounty program and publicly disclosed on April 22, 2021 (GitHub Issue, Go Announce).

The vulnerability affects the ReadRequest and ReadResponse functions in net/http when parsing very large HTTP header values (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). The issue can cause an unrecoverable panic due to stack overflow from recursion. The vulnerability also impacts golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts. The CVSS score for this vulnerability is 5.9 (Medium), with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (Ubuntu CVE).

The vulnerability can lead to a denial of service condition through program crashes. Transport and Client components are vulnerable and can be exploited by a malicious server. While the Server component is not vulnerable by default due to a 1MB header limit, it becomes vulnerable if Server.MaxHeaderBytes is set to a higher value, allowing exploitation by malicious clients (CVE Mitre).

The vulnerability can be exploited remotely by sending HTTP requests with very large headers. The attack complexity is considered high, requires no privileges or user interaction, but has an unchanged scope. While the vulnerability allows for remote exploitation, there are no reported instances of this vulnerability being exploited in the wild (Ubuntu CVE).

The vulnerability was fixed in Go versions 1.15.12 and 1.16.4. Users are advised to upgrade to these versions or later. The fix is also available in golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 for the affected x/net components. For systems that cannot be immediately updated, maintaining the default Server.MaxHeaderBytes limit of 1MB provides partial protection against server-side exploitation (Go Announce).