CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

Published Jan 1, 2022 CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Description
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2891-1 golang-1.8 security update
Debian DLA Debian DLA DLA-2892-1 golang-1.7 security update
Debian DLA Debian DLA DLA-3395-1 golang-1.11 security update
EUVD EUVD EUVD-2022-0700 net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Github GHSA Github GHSA GHSA-vc3p-29h2-gpcp golang.org/x/net/http2 allows uncontrolled memory consumption
History
Type Values Removed Values Added
First Time appeared Redhat stf
CPEs cpe:/a:redhat:service_telemetry_framework:1.3::el8
cpe:/a:redhat:service_telemetry_framework:1.4::el8
cpe:/a:redhat:stf:1.3::el8
cpe:/a:redhat:stf:1.4::el8
Vendors & Products Redhat service Telemetry Framework
Redhat stf