CVE-2022-41717

CVE-2022-41717: fallo en Go standard library net/http

Excessive memory growth in net/http and golang.org/x/net/http2

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear net/http+ Monitorear golang.org/x/net/http2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 6.1%
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Productos afectados
golang.org/x/net · golang.org/x/net/http2Go standard library · net/http
CVEs relacionadas — Go standard library net/http

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%CVE-2022-32148MEDIUMExposure of client IP addresses in net/httpEPSS 1.5%