Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2022-41717

Excessive memory growth in net/http and golang.org/x/net/http2

Summary

Excessive memory growth in net/http and golang.org/x/net/http2

Original description

The description as published by the source.

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami golang
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.9"},{"introduced":"1.19.0"},{"fixed":"1.19.4"}]}]
Go golang.org/x/net/http2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]
Go golang.org/x/net
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details