From 03bccc9aa2a29a03f5a65d56b0ceaace4a66a0d5 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Sat, 11 May 2024 10:33:04 +0800 Subject: [PATCH] fix CVE-2023-29406 --- vendor/golang.org/x/net/http2/transport.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go index 4f09897..e1bb430 100644 --- a/vendor/golang.org/x/net/http2/transport.go +++ b/vendor/golang.org/x/net/http2/transport.go @@ -1739,6 +1739,9 @@ func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trail if err != nil { return nil, err } + if !httpguts.ValidHostHeader(host) { + return nil, errors.New("http: invalid Host header") + } var path string if req.Method != "CONNECT" { -- 2.33.0