CVE-2022-41717: Excessive memory growth in net/http and golang.org/x/net/http2

Published Dec 8, 2022
·
Updated

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Other sources

Excessive memory growth in net/http and golang.org/x/net/http2

— Microsoft

Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By sending a specially-crafted keys, a remote attacker could exploit this vulnerability to cause excessive memory growth, and results in a denial of service condition.

— IBM

Affected Software

42 affected componentsFixes available
go/golang.org/x/net<0.4.0
0.4.0
go/golang.org/x/net/http2<0.4.0
0.4.0
debian/golang-1.15<=1.15.15-1~deb11u4
debian/golang-1.19
1.19.8-2
debian/golang-golang-x-net<=1:0.0+git20210119.5f4716e+dfsg-4
1:0.7.0+dfsg-11:0.27.0-1
Golang Go<1.18.9
Golang Go>=1.19.0<1.19.4
Golang Http2 Go<0.4.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7
redhat/golang<1.19.4
1.19.4
redhat/golang<1.18.9
1.18.9
Microsoft azl3 moby-engine 25.0.3-1<25.0.3-1
25.0.3-1
Microsoft azl3 sriov-network-device-plugin 3.7.0-1<3.7.0-1
3.7.0-1
Microsoft azl3 prometheus 2.45.4-1<2.45.4-1
2.45.4-1
Microsoft cbl2 moby-cli 20.10.27-5<24.0.9-1
24.0.9-1
Microsoft cbl2 azcopy 10.15.0-15<10.24.0-1
10.24.0-1
Microsoft cbl2 containerized-data-importer 1.55.0-23<1.55.0-20
1.55.0-20
Microsoft cbl2 nmi 1.8.11-2<1.8.17-1
1.8.17-1
Microsoft cbl2 gh 2.13.0-2<2.13.0-2
2.13.0-2
Microsoft cbl2 containerized-data-importer 1.55.0-20<1.55.0-20
1.55.0-20
Microsoft azl3 golang 1.17.13-2,1.18.8-2,1.21.6-1<1.17.13-2,1.18.8-2,1.21.6-1
1.17.13-2,1.18.8-2,1.21.6-1
Microsoft cbl2 azcopy 10.24.0-1<10.24.0-1
10.24.0-1
Microsoft cbl2 sriov-network-device-plugin 3.6.2-2<3.6.2-2
3.6.2-2
Microsoft cbl2 moby-cli 24.0.9-1<24.0.9-1
24.0.9-1
Microsoft cbl2 prometheus 2.37.9-1<2.37.9-1
2.37.9-1
Microsoft azl3 sriov-network-device-plugin 3.5.1-3<3.7.0-1
3.7.0-1
Microsoft cbl2 golang 1.18.8-7<1.18.8-3
1.18.8-3
Microsoft cbl2 golang 1.21.6-1<1.21.6-1
1.21.6-1
Microsoft cm1 golang 1.18.8-2<1.18.8-2
1.18.8-2
Microsoft cbl2 golang 1.17.13-2<1.17.13-2
1.17.13-2
Microsoft cbl2 nmi 1.8.17-1<1.8.17-1
1.8.17-1
Microsoft azl3 prometheus 2.37.0-11<2.45.4-1
2.45.4-1
Microsoft cbl2 prometheus 2.37.0-15<2.37.9-1
2.37.9-1
Microsoft azl3 moby-engine 20.10.25-3<25.0.3-1
25.0.3-1
Microsoft cbl2 sriov-network-device-plugin 3.5.1-3<3.6.2-2
3.6.2-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/golang.org/x/net to a version that resolves this vulnerability.

    Fixed in 0.4.0
  2. Upgrade

    Upgrade go/golang.org/x/net/http2 to a version that resolves this vulnerability.

    Fixed in 0.4.0
  3. Upgrade

    Upgrade debian/golang-1.19 to a version that resolves this vulnerability.

    Fixed in 1.19.8-2
  4. Upgrade

    Upgrade debian/golang-golang-x-net to a version that resolves this vulnerability.

    Fixed in 1:0.7.0+dfsg-1Fixed in 1:0.27.0-1
  5. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 1.19.4
  6. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 1.18.9
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.7.0-1
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 25.0.3-1
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 24.0.9-1
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.45.4-1
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.24.0-1
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.55.0-20
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.8.17-1
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.17.13-2,1.18.8-2,1.21.6-1
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.13.0-2
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.6.2-2
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.37.9-1
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.21.6-1
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.18.8-3
  20. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.18.8-2
  21. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.17.13-2
  22. Upgrade

    Upgrade Golang Go to a version that resolves this vulnerability.

    Patch GO-2022-1144
  23. Compensating control

    Mitigate the denial-of-service risk from excessive HTTP/2 header key allocations by limiting exposure to untrusted clients (e.g., restrict/segment network access to the Go server and/or apply rate limiting at a reverse proxy/WAF) so attackers cannot open many HTTP/2 connections and send very large header keys.

Event History

Dec 8, 2022
CVE Published
via MITRE·07:03 PM
Data Sourced
via MITRE·07:03 PM
DescriptionWeakness
Advisory Published
via GitHub·09:30 PM
Dec 13, 2022
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
DescriptionSeverityWeakness
Jan 16, 2023
Data Sourced
via Red Hat·12:54 PM
DescriptionSeverityAffected Software
Oct 10, 2024
Data Sourced
via Ubuntu·01:15 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·01:16 PM
Description
Aug 15, 2025
Data Sourced
via IBM·03:29 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2022-41717?

The severity of CVE-2022-41717 is medium with a severity value of 5.3.

2

How does CVE-2022-41717 affect Go server?

CVE-2022-41717 can cause excessive memory growth in a Go server accepting HTTP/2 requests.

3

What can an attacker do with CVE-2022-41717?

An attacker exploiting CVE-2022-41717 can cause the server to allocate excessive memory by sending very large keys.

4

Which versions of Golang are affected by CVE-2022-41717?

Versions up to and exclusive of 1.18.9 and versions between inclusive and exclusive of 1.19.0 to 1.19.4 are affected by CVE-2022-41717.

5

How can I fix CVE-2022-41717?

To fix CVE-2022-41717, update to Golang version 1.18.9 or 1.19.4, depending on your current version.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203