Resource exhaustion in Golang Go
CVE-2022-41717
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
EPSS: 0.056 (92.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Golang Go
- Golang Http2
- Golang.org/x/net Golang.org/x/net/http2 — versions 0
- Go Standard Library Net/http — versions 0, 1.19.0-0
- Fedoraproject Fedora — versions 37, 38
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@golang.org (Patch, Third Party Advisory)
- security@golang.org (Patch, Vendor Advisory)
- security@golang.org (Patch, Vendor Advisory)
- security@golang.org (Mailing List, Third Party Advisory, Release Notes)
- security@golang.org (Vendor Advisory)
- security@golang.org (Mailing List)
- security@golang.org (Mailing List)
- security@golang.org (Mailing List)
- security@golang.org
- security@golang.org
Frequently asked questions
- What is CVE-2022-41717?
- CVE-2022-41717 is a medium-severity vulnerability in Golang Go, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2022-12-08.
- How severe is CVE-2022-41717?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2022-41717 known to be exploited?
- 14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.