Vulnerability Report: GO-2022-1144
standard library- CVE-2022-41717, GHSA-xrjj-mj9h-534m
- Affects: net/http, golang.org/x/net
- Published: Dec 08, 2022
- Modified: May 20, 2024
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Affected Packages
-
PathGo VersionsSymbols
-
before go1.18.9, from go1.19.0-0 before go1.19.4
-
before v0.4.0
Aliases
References
- https://go.dev/issue/56350
- https://go.dev/cl/455717
- https://go.dev/cl/455635
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
- https://vuln.go.dev/ID/GO-2022-1144.json
Credits
- Josselin Costanzi
Feedback
See anything missing or incorrect?
Suggest an edit to this report.