CVE-2022-41721

HIGH7.5EPSS 0.07%

golang.org/x/net/http2/h2c vulnerable to request smuggling attack

Published: 1/14/2023Modified: 2/4/2026

Also known as:GHSA-fxg5-wq6x-vr4wCGA-x5x2-m4rg-qxmcDEBIAN-CVE-2022-41721GO-2023-1495

Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. ### Specific Go Packages Affected golang.org/x/net/http2/h2c

Affected packages (3)

Debian/golang-golang-x-netfrom 0, < 1:0.4.0+dfsg-1
Go/golang.org/x/net>= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862
Go/golang.org/x/net>= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Affected packages (3)

CVSS scores

References (8)