cve.bz

CVE-2022-41721

7.5 highEPSS 1.8%

High (7.5) in golang h2c. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in golang.org/x/net 0.1.1-0.20221104162952-702349b0e862.

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE
CWE-444
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-fxg5-wq6x-vr4wGogolang.org/x/net>=0.0.0-20220524220425-1d687d428aca <0.1.1-0.20221104162952-702349b0e8620.1.1-0.20221104162952-702349b0e862
GO-2023-1495Gogolang.org/x/net>=0.0.0-20220524220425-1d687d428aca <0.1.1-0.20221104162952-702349b0e8620.1.1-0.20221104162952-702349b0e862

References

Check your stackJSON