CVE-2022-1705medium

CVE-2022-1705: falha de média gravidade em Go standard library net/http

Improper sanitization of Transfer-Encoding headers in net/http

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar net/http+ Monitorar go

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.5%
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Go standard library · net/http
CVEs relacionadas — Go standard library net/http

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 92.0%CVE-2022-41717—Excessive memory growth in net/http and golang.org/x/net/http2EPSS 6.1%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-32148MEDIUMExposure of client IP addresses in net/httpEPSS 1.5%