CVEvulnerability

CVE-2022-41717

5.3 MEDIUM Published 2022-12-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770

Description

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Affected configurations

• golang go (< 1.18.9) • golang go (>= 1.19.0 < 1.19.4) • golang http2 (< 0.4.0) • fedoraproject fedora 37 • fedoraproject fedora 38

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References