CVE-2022-41717
CVE-2022-41717 · Excessive memory growth in net/http and golang.org/x/net/http2
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
CVSS 5.3 · Medium · EPSS 6.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
net/http
- Versions
- ≥ 0, < 1.18.9: Affected (semver)
- ≥ 1.19.0-0, < 1.19.4: Affected (semver)
Update to 1.18.9; Update to 1.19.4
golang.org/x/net/http2
- Versions
- ≥ 0, < 0.4.0: Affected (semver)
Update to 0.4.0
golang-1.19 Debian:12
- Affected ranges
- ECOSYSTEM: < 1.19.4-1
Update to 1.19.4-1
golang-golang-x-net Debian:12
- Affected ranges
- ECOSYSTEM: < 1:0.4.0+dfsg-1
Update to 1:0.4.0+dfsg-1
golang-golang-x-net Debian:13
- Affected ranges
- ECOSYSTEM: < 1:0.4.0+dfsg-1
Update to 1:0.4.0+dfsg-1
golang-golang-x-net Debian:14
- Affected ranges
- ECOSYSTEM: < 1:0.4.0+dfsg-1
Update to 1:0.4.0+dfsg-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- Affected ranges
- ECOSYSTEM: < 1.13.8-1ubuntu1~16.04.3+esm3
Update to 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~18.04.4
Update to 1.18.1-1ubuntu1~18.04.4
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- Affected ranges
- ECOSYSTEM: < 1.13.8-1ubuntu1~18.04.4+esm1
Update to 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: < 1.16.2-0ubuntu1~18.04.2+esm1
Update to 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:20.04:LTS
- Versions
- 1.13.1-1ubuntu1
- 1.13.3-1ubuntu1
- 1.13.4-1ubuntu1
- 1.13.5-1ubuntu1
- 1.13.6-1ubuntu1
- 1.13.6-2ubuntu1
- 1.13.7-1ubuntu1
- 1.13.8-1ubuntu1
- 1.13.8-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 1.13.8-1ubuntu1.2
Update to 1.13.8-1ubuntu1.2
golang-1.16 Ubuntu:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- Affected ranges
- ECOSYSTEM: < 1.16.2-0ubuntu1~20.04.1
Update to 1.16.2-0ubuntu1~20.04.1
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~20.04.2
Update to 1.18.1-1ubuntu1~20.04.2
golang-1.14 Ubuntu:20.04:LTS
- Versions
- 1.14~beta1-1
- 1.14~beta1-2
- 1.14~rc1-1
- 1.14-1
- 1.14.1-1
- 1.14.2-1
- 1.14.2-1ubuntu1
- 1.14.3-2ubuntu2~20.04.1
- 1.14.3-2ubuntu2~20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:22.04:LTS
- Versions
- 1.13.8-1ubuntu2
- 1.13.8-1ubuntu2.22.04.1
- Affected ranges
- ECOSYSTEM: < 1.13.8-1ubuntu2.22.04.2
Update to 1.13.8-1ubuntu2.22.04.2
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:22.04:LTS
- Versions
- 1.18~beta1-0ubuntu1
- 1.18~beta2-1ubuntu1
- 1.18~beta2-1ubuntu2
- 1.18~rc1-1ubuntu1
- 1.18-1ubuntu1
- 1.18.1-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1.1
Update to 1.18.1-1ubuntu1.1
Original sources
- https://go.dev/issue/56350
- https://go.dev/cl/455717
- https://go.dev/cl/455635
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
- https://pkg.go.dev/vuln/GO-2022-1144
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
- https://security.gentoo.org/glsa/202311-09
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/
- https://nvd.nist.gov/vuln/detail/CVE-2022-41717