CVE-2022-41717: Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Other sources
Excessive memory growth in net/http and golang.org/x/net/http2
— Microsoft
Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By sending a specially-crafted keys, a remote attacker could exploit this vulnerability to cause excessive memory growth, and results in a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41717?
The severity of CVE-2022-41717 is medium with a severity value of 5.3.
How does CVE-2022-41717 affect Go server?
CVE-2022-41717 can cause excessive memory growth in a Go server accepting HTTP/2 requests.
What can an attacker do with CVE-2022-41717?
An attacker exploiting CVE-2022-41717 can cause the server to allocate excessive memory by sending very large keys.
Which versions of Golang are affected by CVE-2022-41717?
Versions up to and exclusive of 1.18.9 and versions between inclusive and exclusive of 1.19.0 to 1.19.4 are affected by CVE-2022-41717.
How can I fix CVE-2022-41717?
To fix CVE-2022-41717, update to Golang version 1.18.9 or 1.19.4, depending on your current version.