CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

High · published February 28, 2023

CVSS v3.1
7.5
EPSS
5%
Percentile
91.6
In the wild
Unconfirmed
What it is

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.04561 · 91.6th percentile
Published
2023-02-28T17:19Z
EPSS history
Timeline
  • 28 FEB 17:19Z
    Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
    cvelistv5