CVE-2022-41717

CVE-2022-41717: falha em Go standard library net/http

Excessive memory growth in net/http and golang.org/x/net/http2

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar net/http+ Monitorar golang.org/x/net/http2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 6.1%
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Produtos afetados
golang.org/x/net · golang.org/x/net/http2Go standard library · net/http
CVEs relacionadas — Go standard library net/http

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%CVE-2022-32148MEDIUMExposure of client IP addresses in net/httpEPSS 1.5%