CVE-2022-41723
CVE-2022-41723 · Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVSS 7.5 · High · EPSS 4.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
net/http
- Versions
- ≥ 0, < 1.19.6: Affected (semver)
- ≥ 1.20.0-0, < 1.20.1: Affected (semver)
Update to 1.19.6; Update to 1.20.1
golang.org/x/net/http2
- Versions
- ≥ 0, < 0.7.0: Affected (semver)
Update to 0.7.0
golang.org/x/net/http2/hpack
- Versions
- ≥ 0, < 0.7.0: Affected (semver)
Update to 0.7.0
golang-1.19 Debian:12
- Affected ranges
- ECOSYSTEM: < 1.19.6-2
Update to 1.19.6-2
golang-golang-x-net Debian:12
- Affected ranges
- ECOSYSTEM: < 1:0.7.0+dfsg-1
Update to 1:0.7.0+dfsg-1
golang-golang-x-net Debian:13
- Affected ranges
- ECOSYSTEM: < 1:0.7.0+dfsg-1
Update to 1:0.7.0+dfsg-1
golang-golang-x-net Debian:14
- Affected ranges
- ECOSYSTEM: < 1:0.7.0+dfsg-1
Update to 1:0.7.0+dfsg-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net-dev Ubuntu:Pro:16.04:LTS
- Versions
- 0.0+git20150226.3d87fd6-3
- 0.0+git20151007.b846920+dfsg-1
- 1:0.0+git20150817.66f0418-1
- 1:0.0+git20160110.4fd4a9f-1
- 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
Update to 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
juju-core Ubuntu:Pro:16.04:LTS
- Versions
- 1.24.6-0ubuntu3
- 1.25.0-0ubuntu1
- 1.25.0-0ubuntu2
- 1.25.0-0ubuntu3
- 2.0~beta4-0ubuntu2
- 2.0~beta6-0ubuntu1.16.04.1
- 2.0~beta7-0ubuntu1.16.04.1
- 2.0~beta12-0ubuntu1.16.04.1
- 2.0~beta15-0ubuntu2.16.04.1
- 2.0.0-0ubuntu0.16.04.2
- 2.0.2-0ubuntu0.16.04.1
- 2.0.2-0ubuntu0.16.04.2
- 2.3.1-0ubuntu0.16.04.1
- 2.3.2-0ubuntu0.16.04.1
- 2.3.7-0ubuntu0.16.04.1
- 2.3.7-0ubuntu0.16.04.1+esm1
- Affected ranges
- ECOSYSTEM: < 2.3.7-0ubuntu0.16.04.1+esm2
Update to 2.3.7-0ubuntu0.16.04.1+esm2
lxd Ubuntu:Pro:16.04:LTS
- Versions
- 0.20-0ubuntu4
- 0.21-0ubuntu3
- 0.21-0ubuntu5
- 0.22-0ubuntu1
- 0.22-0ubuntu2
- 0.23-0ubuntu1
- 0.23-0ubuntu2
- 0.23-0ubuntu3
- 0.24-0ubuntu2
- 0.24-0ubuntu3
- 0.24-0ubuntu4
- 0.25-0ubuntu1
- 0.26-0ubuntu2
- 0.26-0ubuntu3
- 0.27-0ubuntu1
- 0.27-0ubuntu2
- 2.0.0~beta1-0ubuntu3
- 2.0.0~beta1-0ubuntu4
- 2.0.0~beta2-0ubuntu1
- 2.0.0~beta2-0ubuntu2
- 2.0.0~beta3-0ubuntu1
- 2.0.0~beta3-0ubuntu2
- 2.0.0~beta3-0ubuntu3
- 2.0.0~beta3-0ubuntu4
- 2.0.0~beta4-0ubuntu1
- 2.0.0~beta4-0ubuntu2
- 2.0.0~beta4-0ubuntu3
- 2.0.0~beta4-0ubuntu4
- 2.0.0~beta4-0ubuntu5
- 2.0.0~beta4-0ubuntu6
- 2.0.0~beta4-0ubuntu7
- 2.0.0~rc1-0ubuntu1
- 2.0.0~rc1-0ubuntu2
- 2.0.0~rc1-0ubuntu3
- 2.0.0~rc2-0ubuntu2
- 2.0.0~rc2-0ubuntu3
- 2.0.0~rc3-0ubuntu1
- 2.0.0~rc3-0ubuntu2
- 2.0.0~rc3-0ubuntu3
- 2.0.0~rc3-0ubuntu4
- 2.0.0~rc4-0ubuntu1
- 2.0.0~rc5-0ubuntu1
- 2.0.0~rc6-0ubuntu1
- 2.0.0~rc6-0ubuntu2
- 2.0.0~rc7-0ubuntu1
- 2.0.0~rc7-0ubuntu2
- 2.0.0~rc8-0ubuntu1
- 2.0.0~rc8-0ubuntu2
- 2.0.0~rc8-0ubuntu3
- 2.0.0~rc8-0ubuntu5
- 2.0.0~rc8-0ubuntu6
- 2.0.0~rc8-0ubuntu7
- 2.0.0~rc9-0ubuntu2
- 2.0.0~rc9-0ubuntu3
- 2.0.0~rc9-0ubuntu4
- 2.0.0~rc9-0ubuntu5
- 2.0.0-0ubuntu1
- 2.0.0-0ubuntu2
- 2.0.0-0ubuntu3
- 2.0.0-0ubuntu4
- 2.0.1-0ubuntu1~16.04.1
- 2.0.2-0ubuntu1~16.04.1
- 2.0.3-0ubuntu1~ubuntu16.04.2
- 2.0.4-0ubuntu1~ubuntu16.04.1
- 2.0.5-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.2
- 2.0.9-0ubuntu1~16.04.1
- 2.0.9-0ubuntu1~16.04.2
- 2.0.10-0ubuntu1~16.04.1
- 2.0.10-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.4
- 2.0.11-0ubuntu1~16.04.4+esm1
- Affected ranges
- ECOSYSTEM: < 2.0.11-0ubuntu1~16.04.4+esm2
Update to 2.0.11-0ubuntu1~16.04.4+esm2
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~16.04.6+esm1
Update to 1.18.1-1ubuntu1~16.04.6+esm1
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:18.04:LTS
- Versions
- 2.18-0ubuntu6
- 2.19-0ubuntu1
- 2.20-0ubuntu3
- 2.20-0ubuntu4
- 2.21-0ubuntu1
- 2.21-0ubuntu2
- 2.21-0ubuntu3
- 2.21-0ubuntu4
- 3.0.0~beta2-0ubuntu3
- 3.0.0~beta3-0ubuntu3
- 3.0.0~beta5-0ubuntu2
- 3.0.0~beta7-0ubuntu1
- 3.0.0-0ubuntu1
- 3.0.0-0ubuntu2
- 3.0.0-0ubuntu3
- 3.0.0-0ubuntu4
- 3.0.1-0ubuntu1~18.04.1
- 3.0.2-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.2
- 3.0.3-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: < 3.0.3-0ubuntu1~18.04.2+esm2
Update to 3.0.3-0ubuntu1~18.04.2+esm2
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~18.04.4+esm1
Update to 1.18.1-1ubuntu1~18.04.4+esm1
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net-dev Ubuntu:Pro:18.04:LTS
- Versions
- 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu1
- 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu2
- 1:0.0+git20170629.c81e7f2+dfsg-2
- 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2
Update to 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- 1.18.1-1ubuntu1~20.04.2
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~20.04.3
Update to 1.18.1-1ubuntu1~20.04.3
Original sources
- https://go.dev/issue/57855
- https://go.dev/cl/468135
- https://go.dev/cl/468295
- https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
- https://pkg.go.dev/vuln/GO-2023-1571
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/
- https://www.couchbase.com/alerts/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20230331-0010/
- https://nvd.nist.gov/vuln/detail/CVE-2022-41723