CVE-2022-41717

CVE-2022-41717: vulnerability in Go standard library net/http

Excessive memory growth in net/http and golang.org/x/net/http2

Published · Updated

Follow this CVE+ Monitor net/http+ Monitor golang.org/x/net/http2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 6.1%
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Affected products
golang.org/x/net · golang.org/x/net/http2Go standard library · net/http
Related CVEs — Go standard library net/http

In the same product, most dangerous first.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%CVE-2022-32148MEDIUMExposure of client IP addresses in net/httpEPSS 1.5%