CVE-2022-41723
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
HIGH 7.5EPSS 4.6%
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
- Affected
- Go standard library · golang.org/x/net · net/http · golang.org/x/net/http2 · golang.org/x/net/http2/hpack
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 4.56% chance of exploitation in the next 30 days, 92nd percentile
- Published
- 2023-02-28
- Updated
- 2025-05-05
Proof-of-concept exploits (1)
- knabben/dos-poc5★ · 2024-04-16
Security advisories
- https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
- https://pkg.go.dev/vuln/GO-2023-1571
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me…
- advisories/GHSA-vvpx-j8f3-3w6h
- https://go.dev/cl/468135
- https://go.dev/cl/468295
- https://go.dev/issue/57855