Skip to content
Log inStart free trial

GHSA-fxg5-wq6x-vr4w CVE-2022-41721 GO-2023-1495

golang.org/x/net/http2/h2c vulnerable to request smuggling attack

High Go
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
1.82%
Chance of exploitation in the next 30 days. Higher than 78.69% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Fix
0.1.1-0.20221104162952-702349b0e862
Upgrade golang.org/x/net to this version or later

Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Specific Go Packages Affected

golang.org/x/net/http2/h2c

Affected versions

Go

PackageVulnerableFixed in
golang.org/x/net
>= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862
0.1.1-0.20221104162952-702349b0e862

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

golang.org/x/net Go → 0.1.1-0.20221104162952-702349b0e862

go
go get golang.org/x/net@v0.1.1-0.20221104162952-702349b0e862 && go mod tidy

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Weakness

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

How to prevent it
  • Implementation: Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
  • Implementation: Use only SSL communication.
  • Implementation: Terminate the client session after each request.
  • System Configuration: Turn all pages to non-cacheable.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-4374-p667-p6c8
HTTP/2 rapid reset can cause excessive work in net/http
High Known exploited Also affects golang.org/x/net
GHSA-qppj-fm5r-hxr3
HTTP/2 Stream Cancellation Attack
Medium Known exploited Also affects golang.org/x/net
GO-2026-6866
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
Not rated yet Also affects golang.org/x/net
GO-2026-6860
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
Not rated yet Also affects golang.org/x/net
GO-2026-6617
HTTP/2 server crash due to HPACK encoder race in net/http
High Also affects golang.org/x/net
GO-2026-6612
Double flow control refund on HTTP/2 server streams in net/http
Critical Also affects golang.org/x/net
GO-2026-6611
Excessive CPU consumption from repeated initial window changes in net/http
High Also affects golang.org/x/net
GO-2026-6610
HTTP/2 transport accepts malformed framing-related headers in net/http
High Also affects golang.org/x/net

Credits: John Howard (Google)

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor