GitHub Advisoryadvisory · Go

GHSA-fxg5-wq6x-vr4w golang.org/x/net/http2/h2c vulnerable to request smuggling attack

HIGH Published 2023-01-14 Modified 2025-04-04 Official page ↗
Aliases
CVE-2022-41721
Ecosystem
Go
Packages
golang.org/x/net
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-444
Reviewed
2023-01-20

Affected packages

• Go golang.org/x/net: >= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862 → fixed in 0.1.1-0.20221104162952-702349b0e862

Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. Specific Go Packages Affected golang.org/x/net/http2/h2c

Related

Alias · CVE (1)

  • CVE-2022-41721 A request smuggling attack is possible when using MaxBytesHandler. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References