CVE-2022-41721high

CVE-2022-41721: high-severity vulnerability in golang.org/x/net/http2/h2c

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

Published · Updated

Follow this CVE+ Monitor golang.org/x/net/http2/h2c+ Monitor golang.org/x/net

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.8%
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
golang.org/x/net · golang.org/x/net/http2/h2c