CVE-2022-41721: Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Other sources
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead read the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using MaxBytesHandler. By sending a specially-crafted HTTP(S) transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-41721?
CVE-2022-41721 is a vulnerability that allows for a request smuggling attack when using MaxBytesHandler.
What is the severity of CVE-2022-41721?
CVE-2022-41721 has a severity level of high.
How does CVE-2022-41721 work?
CVE-2022-41721 occurs when the body of an HTTP request is not fully consumed, allowing an attacker to manipulate the request and potentially carry out a request smuggling attack.
What software is affected by CVE-2022-41721?
The software affected by CVE-2022-41721 includes golang.org/x/net, golang.org/x/net/http2/h2c, and Golang H2c.
How can I fix CVE-2022-41721?
To fix CVE-2022-41721, update your affected software to the recommended version provided by the vendor.