CVE-2022-41717

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
Go standard librarynet/http< 1.18.9; >= 1.19.0-0, < 1.19.4
golang.org/x/netgolang.org/x/net/http2< 0.4.0

References

Timeline

Published
Dec 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-417197.5Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.CVE-2022-41726.5An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_ersCVE-2022-417207.5On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of CVE-2022-417217.5A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consCVE-2022-417227.5A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path CVE-2022-417237.5A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service fromCVE-2022-417247.5Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers anCVE-2022-417257.5A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipaCVE-2022-417275.5An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead CVE-2022-41738.8A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem,CVE-2022-417319.8IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL CVE-2022-417325.5IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.
CVE-2022-41717: Medium severity, CVSS 5.3 | Vulnix