An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
References
Configurations
History
21 Nov 2024, 07:23
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://go.dev/cl/455635 - Patch, Vendor Advisory | |
| References | () https://go.dev/cl/455717 - Patch, Vendor Advisory | |
| References | () https://go.dev/issue/56350 - Patch, Third Party Advisory | |
| References | () https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ - Mailing List, Release Notes, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/ - | |
| References | () https://pkg.go.dev/vuln/GO-2022-1144 - Vendor Advisory | |
| References | () https://security.gentoo.org/glsa/202311-09 - |
18 Jan 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Dec 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Nov 2023, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Nov 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Sep 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Sep 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Sep 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Aug 2023, 17:19
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fedoraproject fedora
Fedoraproject |
|
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/ - Mailing List | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/ - Mailing List | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/ - Mailing List | |
| CPE | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
25 Jul 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Jul 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2022-12-08 20:15
Updated : 2024-11-21 07:23
NVD link : CVE-2022-41717
Mitre link : CVE-2022-41717
CVE.ORG link : CVE-2022-41717
JSON object : View
Products Affected
golang
- http2
- go
fedoraproject
- fedora
CWE
CWE-770
Allocation of Resources Without Limits or Throttling