CVE-2022-41717

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Affected Products (NVD)
VendorProductVersion
golanggo
𝑥
< 1.18.9
golanggo
1.19.0 ≤
𝑥
< 1.19.4
golanghttp2
𝑥
< 0.4.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
buster
postponed
golang-1.19
bookworm
1.19.8-2
fixed
bullseye
no-dsa
buster
postponed
golang-golang-x-net
bookworm
1:0.7.0+dfsg-1
fixed
bullseye
no-dsa
buster
postponed
sid
1:0.27.0-1
fixed
trixie
1:0.27.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang
bionic
dne
focal
dne
jammy
dne
kinetic
dne
trusty
ignored
xenial
ignored
golang-1.10
bionic
needed
focal
dne
jammy
dne
kinetic
dne
trusty
needs-triage
xenial
needs-triage
golang-1.13
bionic
Fixed 1.13.8-1ubuntu1~18.04.4+esm1
released
focal
Fixed 1.13.8-1ubuntu1.2
released
jammy
Fixed 1.13.8-1ubuntu2.22.04.2
released
kinetic
ignored
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
Fixed 1.13.8-1ubuntu1~16.04.3+esm3
released
golang-1.14
bionic
dne
focal
needed
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
golang-1.16
bionic
Fixed 1.16.2-0ubuntu1~18.04.2+esm1
released
focal
Fixed 1.16.2-0ubuntu1~20.04.1
released
jammy
dne
kinetic
dne
trusty
ignored
xenial
ignored
golang-1.17
bionic
dne
focal
dne
jammy
needed
kinetic
dne
trusty
ignored
xenial
ignored
golang-1.18
bionic
Fixed 1.18.1-1ubuntu1~18.04.4
released
focal
Fixed 1.18.1-1ubuntu1~20.04.2
released
jammy
Fixed 1.18.1-1ubuntu1.1
released
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
ignored
xenial
Fixed 1.18.1-1ubuntu1~16.04.4
released
golang-1.6
bionic
dne
focal
dne
jammy
dne
kinetic
dne
trusty
ignored
xenial
needs-triage
golang-1.8
bionic
needed
focal
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
golang-1.9
bionic
needed
focal
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
buildah
RHEL 9
1:1.29.1-1.el9
fixed
buildah-tests
RHEL 9
1:1.29.1-1.el9
fixed
conmon
RHEL 9
2:2.1.7-1.el9_2
fixed
containernetworking-plugins
RHEL 9
1:1.2.0-1.el9
fixed
git-lfs
RHEL 9
0:3.2.0-1.el9
fixed
golang
RHEL 9
0:1.18.9-1.el9_1
fixed
golang-bin
RHEL 9
0:1.18.9-1.el9_1
fixed
golang-docs
RHEL 9
0:1.18.9-1.el9_1
fixed
golang-misc
RHEL 9
0:1.18.9-1.el9_1
fixed
golang-race
RHEL 9
0:1.18.9-1.el9_1
fixed
golang-src
RHEL 9
0:1.18.9-1.el9_1
fixed
golang-tests
RHEL 9
0:1.18.9-1.el9_1
fixed
grafana
RHEL 9
0:9.2.10-7.el9_3
fixed
osbuild-composer
RHEL 8
0:75-1.el8
fixed
RHEL 9
0:76-2.el9_2
fixed
osbuild-composer-core
RHEL 8
0:75-1.el8
fixed
RHEL 9
0:76-2.el9_2
fixed
osbuild-composer-dnf-json
RHEL 8
0:75-1.el8
fixed
RHEL 9
0:76-2.el9_2
fixed
osbuild-composer-worker
RHEL 8
0:75-1.el8
fixed
RHEL 9
0:76-2.el9_2
fixed
podman
RHEL 9
2:4.4.1-3.el9
fixed
podman-docker
RHEL 9
2:4.4.1-3.el9
fixed
podman-gvproxy
RHEL 9
2:4.4.1-3.el9
fixed
podman-plugins
RHEL 9
2:4.4.1-3.el9
fixed
podman-remote
RHEL 9
2:4.4.1-3.el9
fixed
podman-tests
RHEL 9
2:4.4.1-3.el9
fixed
skopeo
RHEL 9
2:1.11.2-0.1.el9
fixed
skopeo-tests
RHEL 9
2:1.11.2-0.1.el9
fixed
toolbox
RHEL 9
0:0.0.99.3-9.el9
fixed
toolbox-tests
RHEL 9
0:0.0.99.3-9.el9
fixed
weldr-client
RHEL 8
0:35.9-2.el8
fixed
RHEL 9
0:35.9-1.el9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
golang
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-bin
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-docs
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-misc
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-race
Amazon Linux 1
0:1.18.6-1.43.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-shared
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-src
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
golang-tests
Amazon Linux 1
0:1.20.8-1.47.amzn1
fixed
Amazon Linux 2
0:1.18.9-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.19.8-1.amzn2023.0.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
azcopy
CBL-Mariner 2.0
0:10.24.0-1.cm2
fixed
containerized-data-importer
CBL-Mariner 2.0
0:1.55.0-20.cm2
fixed
gh
CBL-Mariner 2.0
0:2.13.0-2.cm2
fixed
golang
CBL-Mariner 1.0
0:1.18.8-2.cm1
fixed
CBL-Mariner 2.0
0:1.21.6-1.cm2
fixed
moby-cli
CBL-Mariner 2.0
0:24.0.9-1.cm2
fixed
moby-engine
Azure Linux 3.0
0:25.0.3-1.azl3
fixed
nmi
CBL-Mariner 2.0
0:1.8.17-1.cm2
fixed
podman
Azure Linux 3.0
0:5.6.1-2.azl3
fixed
prometheus
Azure Linux 3.0
0:2.45.4-1.azl3
fixed
CBL-Mariner 2.0
0:2.37.9-1.cm2
fixed
sriov-network-device-plugin
Azure Linux 3.0
0:3.7.0-1.azl3
fixed
CBL-Mariner 2.0
0:3.6.2-2.cm2
fixed
Common Weakness Enumeration
References
https://go.dev/cl/455635
https://go.dev/cl/455717
https://go.dev/issue/56350
https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/
https://pkg.go.dev/vuln/GO-2022-1144
https://security.gentoo.org/glsa/202311-09
https://go.dev/cl/455635
https://go.dev/cl/455717
https://go.dev/issue/56350
https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/
https://pkg.go.dev/vuln/GO-2022-1144
https://security.gentoo.org/glsa/202311-09
https://security.netapp.com/advisory/ntap-20230120-0008/