CVE-2022-41717

Excessive memory growth in net/http and golang.org/x/net/http2

published December 8, 2022

CVSS
—
EPSS
6%
Percentile
93.4
In the wild
Unconfirmed
What it is

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06077 · 93.4th percentile
Published
2022-12-08T19:03Z
EPSS history
Timeline
  • 08 DEC 19:03Z
    Excessive memory growth in net/http and golang.org/x/net/http2
    cvelistv5