CVE-2021-44716: High severity Golang Go vulnerability

Published Dec 9, 2021
ยท
Updated

An attacker can cause unbounded memory growth in a Go server accepting HTTP/2 requests.

Reference: https://github.com/golang/go/issues/50058

Other sources

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader() function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of service or otherwise impact to system performance and resources.

Affected Software

107 affected componentsFixes available
redhat/openshift-serverless-clients<0:1.0.0-2.el8
0:1.0.0-2.el8
redhat/go-toolset<1.16-0:1.16.12-1.el7_9
1.16-0:1.16.12-1.el7_9
redhat/go-toolset<1.16-golang-0:1.16.12-1.el7_9
1.16-golang-0:1.16.12-1.el7_9
redhat/grafana<0:7.5.9-5.el8_5
0:7.5.9-5.el8_5
redhat/grafana<0:7.3.6-4.el8_4
0:7.3.6-4.el8_4
redhat/etcd<0:3.3.23-9.el7
0:3.3.23-9.el7
redhat/grafana<0:5.2.4-5.el7
0:5.2.4-5.el7
redhat/cri-o<0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
redhat/openshift<0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
redhat/containernetworking-plugins<0:0.9.1-2.rhaos4.10.el8
0:0.9.1-2.rhaos4.10.el8
redhat/butane<0:0.13.1-2.rhaos4.9.el8
0:0.13.1-2.rhaos4.9.el8
redhat/ignition<0:2.12.0-3.rhaos4.9.el8
0:2.12.0-3.rhaos4.9.el8
redhat/mcg<0:5.10.0-72.el8
0:5.10.0-72.el8
redhat/etcd<0:3.3.23-7.el8
0:3.3.23-7.el8
redhat/kubevirt<0:4.12.0-1057.el7
0:4.12.0-1057.el7
redhat/kubevirt<0:4.12.0-1057.el8
0:4.12.0-1057.el8
Golang Go<1.16.12
Golang Go>=1.17.0<1.17.5
Debian Debian Linux=9.0
NetApp Cloud Insights Telegraf
redhat/Go<1.17.5
1.17.5
redhat/Go<1.16.12
1.16.12
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7
Microsoft cbl2 nmi 1.8.7-15
Patch available
Microsoft azl3 prometheus-process-exporter 0.7.10-15
Patch available
Microsoft cbl2 local-path-provisioner 0.0.21-18
Patch available
Microsoft cbl2 rook 1.6.2-26
Patch available
Microsoft azl3 multus 3.8-13
Patch available
Microsoft cbl2 application-gateway-kubernetes-ingress 1.4.0-25
Patch available
Microsoft cbl2 csi-driver-lvm 0.4.1-17
Patch available
Microsoft cbl2 keda 2.4.0-29
Patch available
Microsoft azl3 node-problem-detector 0.8.10-18
Patch available
Microsoft cbl2 cri-o 1.22.3-14
Patch available
Microsoft cbl2 flannel 0.14.0-25
Patch available
Microsoft cbl2 prometheus-process-exporter 0.7.10-21
Patch available
Microsoft cbl2 node-problem-detector 0.8.10-20
Patch available
Microsoft cbl2 prometheus-node-exporter 1.3.1-26
Patch available
Microsoft cbl2 moby-cli 20.10.27-5
Patch available
Microsoft cbl2 jx 3.2.236-21
Patch available
Microsoft cbl2 libcontainers-common 20210626-7
Patch available
Microsoft cbl2 git-lfs 3.1.4-17
Patch available
Microsoft cbl2 moby-buildx 0.7.1-24
Patch available
Microsoft azl3 keda 2.4.0-15
Patch available
Microsoft cbl2 cf-cli 8.4.0-24
Patch available
Microsoft cbl2 application-gateway-kubernetes-ingress 1.4.0-25
Patch available
Microsoft azl3 moby-engine 25.0.3-1
Patch available
Microsoft azl3 multus 4.0.2-1
Patch available
Microsoft azl3 prometheus-process-exporter 0.8.2-1
Patch available
Microsoft azl3 keda 2.14.0-1
Patch available
Microsoft azl3 moby-engine 20.10.25-3
Patch available
Microsoft cbl2 application-gateway-kubernetes-ingress 1.4.0-19
Patch available
Microsoft cbl2 kured 1.13.2-1
Patch available
Microsoft azl3 node-problem-detector 0.8.15-1
Patch available
Microsoft cbl2 kube-vip-cloud-provider 0.0.2-22
Patch available
Microsoft cbl2 golang 1.17.8-1
Patch available
Microsoft cbl2 cf-cli 8.4.0-16
Patch available
Microsoft cbl2 csi-driver-lvm 0.4.1-15
Patch available
Microsoft cbl2 flannel 0.14.0-21
Patch available
Microsoft cbl2 kube-vip-cloud-provider 0.0.2-16
Patch available
Microsoft cbl2 moby-buildx 0.7.1-18
Patch available
Microsoft cbl2 keda 2.4.0-19
Patch available
Microsoft cbl2 jx 3.2.236-16
Patch available
Microsoft cbl2 libcontainers-common 20210626-3
Patch available
Microsoft cbl2 prometheus-node-exporter 1.3.1-24
Patch available
Microsoft cbl2 local-path-provisioner 0.0.21-16
Patch available
Microsoft cm1 golang 1.16.12-1
Patch available
Microsoft cbl2 prometheus-process-exporter 0.7.10-19
Patch available
Microsoft cbl2 nmi 1.8.11-2
Patch available
Microsoft cbl2 rook 1.6.2-19
Patch available
Microsoft cri-o-1.21.7-2.cm2.x86_64.rpm
Patch available
Microsoft cbl2 cri-o 1.21.7-2
Patch available
Microsoft node-problem-detector-0.8.15-1.azl3.aarch64.rpm
Patch available
Microsoft multus-k8s-yaml-4.0.2-1.azl3.aarch64.rpm
Patch available
Microsoft node-problem-detector-config-0.8.15-1.azl3.aarch64.rpm
Patch available
Microsoft keda-2.14.0-1.azl3.aarch64.rpm
Patch available
Microsoft node-problem-detector-config-0.8.15-1.azl3.x86_64.rpm
Patch available
Microsoft multus-debuginfo-4.0.2-1.azl3.aarch64.rpm
Patch available
Microsoft multus-4.0.2-1.azl3.aarch64.rpm
Patch available
Microsoft moby-engine-25.0.3-2.azl3.aarch64.rpm
Patch available
Microsoft multus-debuginfo-4.0.2-1.azl3.x86_64.rpm
Patch available
Microsoft multus-k8s-yaml-4.0.2-1.azl3.x86_64.rpm
Patch available
Microsoft csi-driver-lvm-0.4.1-15.cm2.aarch64.rpm
Patch available
Microsoft multus-4.0.2-1.azl3.x86_64.rpm
Patch available
Microsoft cri-o-kubeadm-criconfig-1.21.7-2.cm2.aarch64.rpm
Patch available
Microsoft csi-driver-lvm-lvmplugin-0.4.1-15.cm2.aarch64.rpm
Patch available
Microsoft csi-driver-lvm-csi-lvmplugin-provisioner-0.4.1-15.cm2.aarch64.rpm
Patch available
Microsoft node-problem-detector-0.8.15-1.azl3.x86_64.rpm
Patch available
Microsoft application-gateway-kubernetes-ingress-1.4.0-19.cm2.aarch64.rpm
Patch available
Microsoft csi-driver-lvm-debuginfo-0.4.1-15.cm2.x86_64.rpm
Patch available
Microsoft cf-cli-8.4.0-16.cm2.aarch64.rpm
Patch available
Microsoft csi-driver-lvm-csi-lvmplugin-provisioner-0.4.1-15.cm2.x86_64.rpm
Patch available
Microsoft cri-o-kubeadm-criconfig-1.21.7-2.cm2.x86_64.rpm
Patch available
Microsoft golang-1.16.12-1.cm1.aarch64.rpm
Patch available
Microsoft moby-engine-25.0.3-2.azl3.x86_64.rpm
Patch available
Microsoft csi-driver-lvm-0.4.1-15.cm2.x86_64.rpm
Patch available
Microsoft application-gateway-kubernetes-ingress-1.4.0-19.cm2.x86_64.rpm
Patch available
Microsoft keda-2.14.0-1.azl3.x86_64.rpm
Patch available
Microsoft csi-driver-lvm-lvmplugin-0.4.1-15.cm2.x86_64.rpm
Patch available
Microsoft cf-cli-8.4.0-16.cm2.x86_64.rpm
Patch available
Microsoft cri-o-1.21.7-2.cm2.aarch64.rpm
Patch available
Microsoft golang-1.16.12-1.cm1.x86_64.rpm
Patch available
Microsoft csi-driver-lvm-debuginfo-0.4.1-15.cm2.aarch64.rpm
Patch available

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/openshift-serverless-clients to a version that resolves this vulnerability.

    Fixed in 0:1.0.0-2.el8
  2. Upgrade

    Upgrade redhat/go-toolset to a version that resolves this vulnerability.

    Fixed in 1.16-0:1.16.12-1.el7_9
  3. Upgrade

    Upgrade redhat/go-toolset to a version that resolves this vulnerability.

    Fixed in 1.16-golang-0:1.16.12-1.el7_9
  4. Upgrade

    Upgrade redhat/grafana to a version that resolves this vulnerability.

    Fixed in 0:7.5.9-5.el8_5
  5. Upgrade

    Upgrade redhat/grafana to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-4.el8_4
  6. Upgrade

    Upgrade redhat/etcd to a version that resolves this vulnerability.

    Fixed in 0:3.3.23-9.el7
  7. Upgrade

    Upgrade redhat/grafana to a version that resolves this vulnerability.

    Fixed in 0:5.2.4-5.el7
  8. Upgrade

    Upgrade redhat/cri-o to a version that resolves this vulnerability.

    Fixed in 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
  9. Upgrade

    Upgrade redhat/openshift to a version that resolves this vulnerability.

    Fixed in 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  10. Upgrade

    Upgrade redhat/containernetworking-plugins to a version that resolves this vulnerability.

    Fixed in 0:0.9.1-2.rhaos4.10.el8
  11. Upgrade

    Upgrade redhat/butane to a version that resolves this vulnerability.

    Fixed in 0:0.13.1-2.rhaos4.9.el8
  12. Upgrade

    Upgrade redhat/ignition to a version that resolves this vulnerability.

    Fixed in 0:2.12.0-3.rhaos4.9.el8
  13. Upgrade

    Upgrade redhat/mcg to a version that resolves this vulnerability.

    Fixed in 0:5.10.0-72.el8
  14. Upgrade

    Upgrade redhat/etcd to a version that resolves this vulnerability.

    Fixed in 0:3.3.23-7.el8
  15. Upgrade

    Upgrade redhat/kubevirt to a version that resolves this vulnerability.

    Fixed in 0:4.12.0-1057.el7
  16. Upgrade

    Upgrade redhat/kubevirt to a version that resolves this vulnerability.

    Fixed in 0:4.12.0-1057.el8
  17. Upgrade

    Upgrade redhat/Go to a version that resolves this vulnerability.

    Fixed in 1.17.5
  18. Upgrade

    Upgrade redhat/Go to a version that resolves this vulnerability.

    Fixed in 1.16.12
  19. Upgrade

    Upgrade Go net/http to a version that resolves this vulnerability.

    Fixed in 1.16.12
  20. Upgrade

    Upgrade Go net/http to a version that resolves this vulnerability.

    Fixed in 1.17.5
  21. Configuration

    Set GODEBUG=http2server=0 before calling Serve to disable HTTP/2, unless HTTP/2 was manually configured through the golang.org/x/net/http2 package.

    Go net/http HTTP/2 server GODEBUG=http2server = 0

Event History

Dec 9, 2021
CVE Published
12:00 AM
Data Sourced
via Red Hatยท06:36 PM
DescriptionSeverityAffected Software
Jan 1, 2022
CVE Published
via MITREยท12:00 AM
Data Sourced
via MITREยท12:00 AM
Description
Jan 13, 2022
Data Sourced
via Microsoftยท12:00 AM
DescriptionSeverityWeaknessAffected Software
Aug 15, 2025
Data Sourced
via IBMยท03:29 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2021-44716?

CVE-2021-44716 is a vulnerability in the net/http library in Go before 1.16.12 and 1.17.x before 1.17.5.

2

What is the severity of CVE-2021-44716?

CVE-2021-44716 has a severity score of 7.5 (high).

3

How can I exploit CVE-2021-44716?

CVE-2021-44716 can be exploited by submitting specially crafted requests to applications linked with net/http's http2 functionality.

4

How can I fix CVE-2021-44716?

To fix CVE-2021-44716, update your Go installation to version 1.16.12 or 1.17.5, depending on the version you are using.

5

Where can I find more information about CVE-2021-44716?

You can find more information about CVE-2021-44716 in the references provided: [link 1](https://github.com/golang/go/issues/50058), [link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2030802), [link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2030804).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
ยฉ 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203