5.3

CVE-2022-41717: Excessive memory growth in net/http and golang.org/x/net/http2

Modified
AliasesMGASA-2022-0473RHSA-2023:1179RHSA-2023:1276
Published 08-12-2022Last modified 13-02-2025

Vulnerability summary

CVE-2022-41717 is a medium (CVSS 5.3) vulnerability in fedoraproject fedora. EPSS estimates a 6.08% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
6.08%
0%100%
Low · +0.29 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 35 · Related 40
OPENSUSE-SU-2024:12552-1OPENSUSE-SU-2024:12553-1OPENSUSE-SU-2024:12615-1OPENSUSE-SU-2024:13225-1OPENSUSE-SU-2024:14076-1RHSA-2023:0328

Timeline

  1. 08-12-2022
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

6.08%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

Increase +0.29 pp

From 5.78% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard38 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
  • katib-suggestion-nas-darts< 0.19.0-r31
Wolfi24 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
  • katib-suggestion-nas-darts< 0.19.0-r31
Ubuntu9 products
  • golang-1.10All versions (No fix recorded)
  • golang-1.13< 1.13.8-1ubuntu1~16.04.3+esm3 | < 1.13.8-1ubuntu1~18.04.4+esm1 | < 1.13.8-1ubuntu1.2 | < 1.13.8-1ubuntu2.22.04.2
  • golang-1.14All versions (No fix recorded)
  • golang-1.16< 1.16.2-0ubuntu1~18.04.2+esm1 | < 1.16.2-0ubuntu1~20.04.1
  • golang-1.17All versions (No fix recorded)
Redhat5 products
  • collectd-libpod-stats< 0:1.0.4-3.el8ost
  • conmon< 2:2.1.7-1.el9_2
  • conmon-debuginfo< 2:2.1.7-1.el9_2
  • conmon-debugsource< 2:2.1.7-1.el9_2
  • openshift-serverless-clients< 0:1.6.1-2.el8
Alpine2 products
  • go≥ 1.19.0, < 1.19.4-r0
  • minio-client< 0.20230111.031416-r0
Debian2 products
  • golang-1.19< 1.19.4-1
  • golang-golang-x-net< 1:0.4.0+dfsg-1
Golang2 products
  • go< 1.18.9 | ≥ 1.19.0, < 1.19.4
  • http2< 0.4.0
Golang.org/x/net2 products
Fedoraproject1 product
Go1 product
  • stdlib≥ 1.19.0-0, < 1.19.4
Go standard library1 product
  • net/http< 1.18.9 | ≥ 1.19.0-0, < 1.19.4
Golang.org/x1 product
  • net< 0.4.0
Mageia1 product
  • golang< 1.18.9-1.mga8

13 vendors · 89 products

References

75 links
Show all 75 references