AIKIDO-2025-10392
go.uber.org/yarpc is vulnerable to Denial of Service (DoS)
30
Low Risk
This Affects:
go.uber.org/yarpcTL;DR
Affected versions of the package are vulnerable to Denial of Service (DoS) due to the lack of a ReadHeaderTimeout configuration in the HTTP transport inbound. Without this setting, the server is exposed to slow header attacks, where an attacker sends HTTP headers at a slow rate to tie up resources. The patch introduces support for configuring ReadHeaderTimeout, enabling users to set a maximum duration for reading request headers and enhancing the server’s resilience against such attacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
go.uber.org/yarpc is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 1.79.3.
How to fix this
Upgrade the go.uber.org/yarpc library to the patch version and set the ReadHeaderTimeout configuration.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant