CVE-2022-27664

golang: net/http: handle server errors after sending GOAWAY

Published Sep 6, 2022 CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Description
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-6718 In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
Github GHSA Github GHSA GHSA-69cg-p879-7622 golang.org/x/net/http2 Denial of Service vulnerability
Ubuntu USN Ubuntu USN USN-6038-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-6038-2 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-1 Go Networking vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-2 Go Networking vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-3 ADSys, Juju Core, LXD vulnerabilities
Ubuntu USN Ubuntu USN USN-8900-1 Go Networking vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00112}

epss

{'score': 0.00115}

Type Values Removed Values Added
First Time appeared Redhat stf
CPEs cpe:/a:redhat:service_telemetry_framework:1.5::el8 cpe:/a:redhat:stf:1.5::el8
Vendors & Products Redhat service Telemetry Framework
Redhat stf