CVE-2022-41723high

CVE-2022-41723: falha de alta gravidade em Go standard library net/http

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar net/http+ Monitorar golang.org/x/net/http2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 4.6%
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
golang.org/x/net · golang.org/x/net/http2golang.org/x/net · golang.org/x/net/http2/hpackGo standard library · net/http
CVEs relacionadas — Go standard library net/http

No mesmo produto, das mais perigosas para as menos.

CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41717—Excessive memory growth in net/http and golang.org/x/net/http2EPSS 6.1%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%CVE-2022-32148MEDIUMExposure of client IP addresses in net/httpEPSS 1.5%