GitHub Advisoryadvisory · Go

GHSA-vc3p-29h2-gpcp golang.org/x/net/http2 allows uncontrolled memory consumption

HIGH Published 2022-01-02 Modified 2023-02-08 Official page ↗
Aliases
CVE-2021-44716
Ecosystem
Go
Packages
golang.org/x/net/http2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-02-08

Affected packages

• Go golang.org/x/net/http2: < 0.0.0-20211209124913-491a49abca63 → fixed in 0.0.0-20211209124913-491a49abca63

Description

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Related

Alias · CVE (1)

  • CVE-2021-44716 net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References