CVE-2022-41724

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-417257.5A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipa CVE-2022-417275.5An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead CVE-2022-41738.8A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem,CVE-2022-417319.8IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL CVE-2022-417325.5IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.CVE-2022-417335.3IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is res CVE-2022-417347.5IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical erro CVE-2022-417356.1IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site script CVE-2022-417367.8IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0 contains an unspecified vulnerability that could allow a local CVE-2022-417376.5IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a contai CVE-2022-417387.5IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers fro CVE-2022-417398.4IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the cont