CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Published Feb 28, 2023 CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Description
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-0804 A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
Github GHSA Github GHSA GHSA-vvpx-j8f3-3w6h golang.org/x/net vulnerable to Uncontrolled Resource Consumption
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-1 Go Networking vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-2 Go Networking vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-3 ADSys, Juju Core, LXD vulnerabilities
Ubuntu USN Ubuntu USN USN-8900-1 Go Networking vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00229}

epss

{'score': 0.00235}

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}