Log in Start free

Vulnerability · Published Jan 13, 2023 · Assigned by Go

CVE-2022-41721Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

High 7.5

In plain English

A high-severity security flaw in golang.org/x/net/http2/h2c from golang.org/x/net. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.8%top 21.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-golang-x-net1:0.4.0+dfsg-1DEBIAN-CVE-2022-41721
Debian:13golang-golang-x-net1:0.4.0+dfsg-1DEBIAN-CVE-2022-41721
Debian:14golang-golang-x-net1:0.4.0+dfsg-1DEBIAN-CVE-2022-41721
Gogolang.org/x/net0.1.1-0.20221104162952-702349b0e862GO-2023-1495
Gogolang.org/x/net0.1.1-0.20221104162952-702349b0e862GHSA-fxg5-wq6x-vr4w

Affected products (as reported)

VendorProductVersions
golang.org/x/net golang.org/x/net/http2/h2c 0.0.0-20220524220425-1d687d428aca – before 0.1.1-0.20221104162952-702349b0e862

References