CVE-2022-27664: High severity Golang Go vulnerability

Published Sep 6, 2022
·
Updated

A closing HTTP/2 server connection could hang forever waiting for a clean shutdown that was preempted by a subsequent fatal error. This failure mode could be exploited to cause a denial of service.

References: https://go.dev/issue/54658 https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ

Upstream Commits: Master: https://github.com/golang/go/commit/29af494fca8a25d7d46276f6d4835c4dcd09e47d Branch.go1.18 : https://github.com/golang/go/commit/5bc9106458fc07851ac324a4157132a91b1f3479 Branch.go1.19 : https://github.com/golang/go/commit/9cfe4e258b1c9d4a04a42539c21c7bdb2e227824

Other sources

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.

Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a closing HTTP/2 server connection to hang, and results in a denial of service condition.

— IBM

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1 attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

— Microsoft

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Affected Software

52 affected componentsFixes available
redhat/openshift-serverless-clients<0:1.6.1-1.el8
0:1.6.1-1.el8
redhat/git-lfs<0:2.13.3-3.el8_6
0:2.13.3-3.el8_6
redhat/osbuild-composer<0:75-1.el8
0:75-1.el8
redhat/weldr-client<0:35.9-2.el8
0:35.9-2.el8
redhat/grafana<0:7.5.15-4.el8
0:7.5.15-4.el8
redhat/grafana-pcp<0:3.2.0-3.el8
0:3.2.0-3.el8
redhat/golang<0:1.18.9-1.el9_1
0:1.18.9-1.el9_1
redhat/grafana<0:9.0.9-2.el9
0:9.0.9-2.el9
redhat/grafana-pcp<0:5.1.1-1.el9
0:5.1.1-1.el9
redhat/butane<0:0.16.0-1.el9
0:0.16.0-1.el9
redhat/osbuild-composer<0:76-2.el9_2
0:76-2.el9_2
redhat/weldr-client<0:35.9-1.el9
0:35.9-1.el9
redhat/toolbox<0:0.0.99.3-9.el9
0:0.0.99.3-9.el9
redhat/git-lfs<0:3.2.0-1.el9
0:3.2.0-1.el9
redhat/cri-o<0:1.24.4-5.rhaos4.11.git57d7127.el8
0:1.24.4-5.rhaos4.11.git57d7127.el8
redhat/cri-tools<0:1.24.2-7.el8
0:1.24.2-7.el8
redhat/cri-o<0:1.25.1-5.rhaos4.12.git6005903.el8
0:1.25.1-5.rhaos4.12.git6005903.el8
redhat/cri-tools<0:1.25.0-2.el8
0:1.25.0-2.el8
redhat/openshift-clients<0:4.12.0-202301042257.p0.g854f807.assembly.stream.el8
0:4.12.0-202301042257.p0.g854f807.assembly.stream.el8
redhat/podman<3:4.2.0-7.rhaos4.12.el9
3:4.2.0-7.rhaos4.12.el9
redhat/skopeo<2:1.9.4-3.rhaos4.12.el9
2:1.9.4-3.rhaos4.12.el9
redhat/openshift-clients<0:4.12.0-202308151125.p0.gf61957e.assembly.stream.el9
0:4.12.0-202308151125.p0.gf61957e.assembly.stream.el9
redhat/openshift-clients<0:4.13.0-202308112024.p0.g17b7acc.assembly.stream.el9
0:4.13.0-202308112024.p0.g17b7acc.assembly.stream.el9
redhat/etcd<0:3.3.23-12.el8
0:3.3.23-12.el8
redhat/kubevirt<0:4.13.0-1469.el7
0:4.13.0-1469.el7
redhat/kubevirt<0:4.13.0-1469.el8
0:4.13.0-1469.el8
redhat/kubevirt<0:4.13.0-1469.el9
0:4.13.0-1469.el9
go/golang.org/x/net/http2<0.0.0-20220906165146-f3363e06e74c
0.0.0-20220906165146-f3363e06e74c
go/golang.org/x/net<0.0.0-20220906165146-f3363e06e74c
0.0.0-20220906165146-f3363e06e74c
debian/golang-1.15<=1.15.15-1~deb11u4
debian/golang-1.19
1.19.8-2
debian/golang-golang-x-net<=1:0.0+git20210119.5f4716e+dfsg-4
1:0.7.0+dfsg-11:0.27.0-1
Golang Go<1.18.6
Golang Go=1.19.0
Fedoraproject Fedora=36
Fedoraproject Fedora=37
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7
redhat/golang<1.19.1
1.19.1
redhat/golang<1.18.6
1.18.6
Microsoft cbl2 kured 1.13.2-1<1.13.2-1
1.13.2-1
Microsoft cbl2 golang 1.17.13-2
Microsoft azl3 golang 1.18.8-1<1.18.8-1
1.18.8-1
Microsoft cbl2 golang 1.21.6-1<1.21.6-1
1.21.6-1
Microsoft cbl2 golang 1.18.8-1<1.18.8-1
1.18.8-1
Microsoft azl3 golang 1.23.7-1<1.18.8-1
1.18.8-1
Microsoft cm1 golang 1.17.13-2<1.17.13-2
1.17.13-2
Microsoft azl3 golang 1.23.9-1<1.18.8-1
1.18.8-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/openshift-serverless-clients to a version that resolves this vulnerability.

    Fixed in 0:1.6.1-1.el8
  2. Upgrade

    Upgrade redhat/git-lfs to a version that resolves this vulnerability.

    Fixed in 0:2.13.3-3.el8_6
  3. Upgrade

    Upgrade redhat/osbuild-composer to a version that resolves this vulnerability.

    Fixed in 0:75-1.el8
  4. Upgrade

    Upgrade redhat/weldr-client to a version that resolves this vulnerability.

    Fixed in 0:35.9-2.el8
  5. Upgrade

    Upgrade redhat/grafana to a version that resolves this vulnerability.

    Fixed in 0:7.5.15-4.el8
  6. Upgrade

    Upgrade redhat/grafana-pcp to a version that resolves this vulnerability.

    Fixed in 0:3.2.0-3.el8
  7. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 0:1.18.9-1.el9_1
  8. Upgrade

    Upgrade redhat/grafana to a version that resolves this vulnerability.

    Fixed in 0:9.0.9-2.el9
  9. Upgrade

    Upgrade redhat/grafana-pcp to a version that resolves this vulnerability.

    Fixed in 0:5.1.1-1.el9
  10. Upgrade

    Upgrade redhat/butane to a version that resolves this vulnerability.

    Fixed in 0:0.16.0-1.el9
  11. Upgrade

    Upgrade redhat/osbuild-composer to a version that resolves this vulnerability.

    Fixed in 0:76-2.el9_2
  12. Upgrade

    Upgrade redhat/weldr-client to a version that resolves this vulnerability.

    Fixed in 0:35.9-1.el9
  13. Upgrade

    Upgrade redhat/toolbox to a version that resolves this vulnerability.

    Fixed in 0:0.0.99.3-9.el9
  14. Upgrade

    Upgrade redhat/git-lfs to a version that resolves this vulnerability.

    Fixed in 0:3.2.0-1.el9
  15. Upgrade

    Upgrade redhat/cri-o to a version that resolves this vulnerability.

    Fixed in 0:1.24.4-5.rhaos4.11.git57d7127.el8
  16. Upgrade

    Upgrade redhat/cri-tools to a version that resolves this vulnerability.

    Fixed in 0:1.24.2-7.el8
  17. Upgrade

    Upgrade redhat/cri-o to a version that resolves this vulnerability.

    Fixed in 0:1.25.1-5.rhaos4.12.git6005903.el8
  18. Upgrade

    Upgrade redhat/cri-tools to a version that resolves this vulnerability.

    Fixed in 0:1.25.0-2.el8
  19. Upgrade

    Upgrade redhat/openshift-clients to a version that resolves this vulnerability.

    Fixed in 0:4.12.0-202301042257.p0.g854f807.assembly.stream.el8
  20. Upgrade

    Upgrade redhat/podman to a version that resolves this vulnerability.

    Fixed in 3:4.2.0-7.rhaos4.12.el9
  21. Upgrade

    Upgrade redhat/skopeo to a version that resolves this vulnerability.

    Fixed in 2:1.9.4-3.rhaos4.12.el9
  22. Upgrade

    Upgrade redhat/openshift-clients to a version that resolves this vulnerability.

    Fixed in 0:4.12.0-202308151125.p0.gf61957e.assembly.stream.el9
  23. Upgrade

    Upgrade redhat/openshift-clients to a version that resolves this vulnerability.

    Fixed in 0:4.13.0-202308112024.p0.g17b7acc.assembly.stream.el9
  24. Upgrade

    Upgrade redhat/etcd to a version that resolves this vulnerability.

    Fixed in 0:3.3.23-12.el8
  25. Upgrade

    Upgrade redhat/kubevirt to a version that resolves this vulnerability.

    Fixed in 0:4.13.0-1469.el7
  26. Upgrade

    Upgrade redhat/kubevirt to a version that resolves this vulnerability.

    Fixed in 0:4.13.0-1469.el8
  27. Upgrade

    Upgrade redhat/kubevirt to a version that resolves this vulnerability.

    Fixed in 0:4.13.0-1469.el9
  28. Upgrade

    Upgrade go/golang.org/x/net/http2 to a version that resolves this vulnerability.

    Fixed in 0.0.0-20220906165146-f3363e06e74c
  29. Upgrade

    Upgrade go/golang.org/x/net to a version that resolves this vulnerability.

    Fixed in 0.0.0-20220906165146-f3363e06e74c
  30. Upgrade

    Upgrade debian/golang-1.19 to a version that resolves this vulnerability.

    Fixed in 1.19.8-2
  31. Upgrade

    Upgrade debian/golang-golang-x-net to a version that resolves this vulnerability.

    Fixed in 1:0.7.0+dfsg-1Fixed in 1:0.27.0-1
  32. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 1.19.1
  33. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 1.18.6
  34. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.18.8-1
  35. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.13.2-1
  36. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.21.6-1
  37. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.17.13-2
  38. Upgrade

    Upgrade golang/net/http to a version that resolves this vulnerability.

    Fixed in 1.18.6
  39. Upgrade

    Upgrade golang/net/http to a version that resolves this vulnerability.

    Fixed in 1.19.1

Event History

Sep 6, 2022
CVE Published
12:00 AM
CVE Published
via MITRE·05:29 PM
Data Sourced
via MITRE·05:29 PM
Description
Data Sourced
via Red Hat·06:05 PM
DescriptionSeverityAffected Software
Sep 7, 2022
Advisory Published
via GitHub·12:01 AM
Sep 9, 2022
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Oct 10, 2024
Data Sourced
via Ubuntu·01:15 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·01:16 PM
Description
Aug 15, 2025
Data Sourced
via IBM·03:29 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2022-27664?

CVE-2022-27664 is a vulnerability in the golang package that allows a denial of service attack by causing a closing HTTP/2 server connection to hang.

2

How does CVE-2022-27664 affect Golang Go?

CVE-2022-27664 affects Golang Go by enabling a remote attacker to exploit the vulnerability and cause a denial of service condition.

3

What is the severity level of CVE-2022-27664?

CVE-2022-27664 has a severity level of high.

4

How can I fix CVE-2022-27664?

To fix CVE-2022-27664, you need to update the affected software to version 0.0.0-20220906165146-f3363e06e74c or later.

5

Where can I find more information about CVE-2022-27664?

You can find more information about CVE-2022-27664 on the NIST website and the Golang announcement groups.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203