CVE-2022-41721 describes a request smuggling vulnerability affecting Go's h2c server when using MaxBytesHandler. An attacker can manipulate unconsumed HTTP request body data to craft arbitrary HTTP/2 requests, potentially leading to denial-of-service. Rated 7.5 HIGH, this vulnerability has a low attack complexity and requires no user interaction or privileges, but its impact is limited to availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2022-11-04CPE matchmatch criteria | cpe:2.3:a:golang:h2c:*:*:*:*:*:go:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
golang.org/x/net/http2/h2c vulnerable to request smuggling attack
Jan 14, 2023x/net/http2/h2c: request smuggling
Jan 13, 2023Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
Jan 10, 2023