CVE-2022-41721

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

High · published January 13, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
78.5
In the wild
Unconfirmed
What it is

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01814 · 78.5th percentile
Published
2023-01-13T22:46Z
EPSS history
Timeline
  • 13 JAN 22:46Z
    Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
    cvelistv5