What’s Vulnerable › Vulnerabilities
CVE-2022-41721: Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-01-13 · updated 2026-06-17
- Weakness: CWE-444
Description
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Affected products
- golang.org/x/net/http2/h2c: before 2022-11-04 — fixed in 2022-11-04
How to fix
Upgrade to a fixed version: golang.org/x/net/http2/h2c 2022-11-04. Check the vendor advisory for mitigations.
References
- https://go.dev/cl/447396
- https://go.dev/issue/56352
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/
- https://pkg.go.dev/vuln/GO-2023-1495
- https://go.dev/cl/447396
- https://go.dev/issue/56352
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/
- https://pkg.go.dev/vuln/GO-2023-1495
Get alerted when CVE-2022-41721 or the next vulnerability affects your stack