CVEvulnerability
CVE-2022-41721
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-01-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-444
Description
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Affected configurations
• golang h2c (< 2022-11-04)
Related
Weakness · CWE (1)
- CWE-444 Inconsistent Interpretation of HTTP Requests weakness
References
- https://go.dev/cl/447396 Patch, Vendor Advisory
- https://go.dev/issue/56352 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/ lists.fedoraproject.org
- https://pkg.go.dev/vuln/GO-2023-1495 Vendor Advisory
- https://go.dev/cl/447396 Patch, Vendor Advisory
- https://go.dev/issue/56352 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/ lists.fedoraproject.org
- https://pkg.go.dev/vuln/GO-2023-1495 Vendor Advisory