QID 357251

A malicious http sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.
A malicious http client can further exploit this to cause a server to automatically read a large amount of data (up to about 1gib) when a handler fails to read the entire body of a request.
Chunk extensions are a little-used http feature which permit including additional metadata in a request or response body sent using the chunked encoding.
The net/http chunked encoding reader discards this metadata.
A sender can exploit this by inserting a large metadata segment with each byte transferred.
The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. (
( CVE-2023-39326)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.