CVE-2022-41723
Aliases:GHSA-vvpx-j8f3-3w6hBIT-golang-2022-41723GO-2023-1571RHSA-2023:7058RHSA-2024:0948DEBIAN-CVE-2022-41723CGA-2p24-5gwh-5684CGA-2p6v-fm8p-45c9CGA-2p8x-64x5-qcx7CGA-3mxq-cxj6-rww5CGA-3v3c-gp98-fmh2CGA-44g4-89g3-3pgpCGA-4764-w239-hq29CGA-4rpj-43hr-4gc6CGA-598g-m8h5-ppcfCGA-6f35-fv9f-x9f5CGA-6rmr-923w-9gmwCGA-788v-32hj-crgrCGA-7chg-hwwp-xgj4CGA-7p38-pfx4-v632CGA-83rv-p2g9-f9fmCGA-85wp-p8c6-fvp6CGA-89jj-7f53-77v4CGA-8g55-ff44-h87fCGA-9354-r77f-xvfgCGA-93g5-4fgg-hq5cCGA-99h8-rm5j-fv2xCGA-9cgx-q72w-2j2mCGA-9cm7-gm2g-hj3mCGA-9hhm-fr6h-w99jCGA-9w22-xch4-qqpvCGA-c333-475v-6v74CGA-c3rp-j9qp-g4q2CGA-cc7j-gfh8-6qhfCGA-cm74-m27p-qq8hCGA-cv5v-qrg2-jmq3CGA-f4g7-6926-59pmCGA-fhch-c6mv-8v8qCGA-gjgq-45hw-x4mgCGA-gvw6-j9qq-x52qCGA-hfh4-pvv6-m4p7CGA-hg42-3j33-96fgCGA-hwhp-5695-m8hmCGA-j8p7-4863-vr7mCGA-j8qm-w79j-h92jCGA-jh76-5vv8-mc4pCGA-m27r-f8jg-q6jmCGA-m67r-53gg-43h7CGA-m934-5582-7xg3CGA-mmj5-rgh5-jr9jCGA-mvjg-rwv2-4957CGA-mwcg-j5p3-v7pgCGA-p23w-fh9m-wfhgCGA-27fw-442g-f7wjCGA-2p7m-vv7r-gfxqCGA-2xxv-jcxw-m8cjCGA-3876-3crw-f5m6CGA-39p8-grwv-8872CGA-3gmq-wvvh-59j3CGA-44hm-q5vf-ppj2CGA-4vq8-gwmc-2jqwCGA-59r8-88wv-r63pCGA-6826-mqvc-p75qCGA-6mp8-mpxv-q336CGA-6rpq-f77h-fhq7CGA-85hv-m78w-7qg9CGA-89xh-m2cw-2pxxCGA-8cj9-4cp6-qrvcCGA-9g8r-gv64-4wj3CGA-cgcx-vw6g-97w9CGA-cv46-5hr2-q262CGA-cx9g-66jq-78q8CGA-fhx2-7h88-x977CGA-frpc-2xwv-r6hrCGA-gq9f-8j2w-xr38CGA-h8pg-8rv8-28hxCGA-j6qc-7wp5-pwvhCGA-m6pq-p267-7657CGA-mjjh-p4w6-pcg5CGA-mrfx-x76q-6h96CGA-mxw4-7c3c-prh9CGA-p47r-547c-84jmCGA-pqm3-3gfh-5jhgCGA-q454-2vhm-5j56CGA-q9fc-q3x7-8v2mCGA-qgvg-fc7q-4ccjCGA-qppq-9wxv-f4gqCGA-qqv4-5wpp-8j2jCGA-qvm2-h8m4-mq5cCGA-qwqp-jgg3-8293CGA-qxfc-5x4g-x3rrCGA-qxfr-2r39-6wqrCGA-r6hg-mxf9-vg8rCGA-rjqv-26wf-77v7CGA-rpc4-hrh5-gwr2CGA-rpwg-pf7v-5fr9CGA-rwjc-2478-4428CGA-v54h-c9m8-cjwrCGA-v57j-7hx9-67hvCGA-vvp2-f92v-xcgfCGA-w3pg-w54q-xg69CGA-w4mg-9v3r-r6v2CGA-w5gg-q779-fpj7CGA-w7fm-2grp-m897CGA-w98x-4jfp-mxgvCGA-wj99-q7vf-m7pgCGA-wvg6-xp79-g55xCGA-x5cv-5jp8-fxrcCGA-x9c7-g27v-hp92CGA-xc4h-mr7c-gvghCGA-xp77-45vv-h23fCGA-xqh6-5qxx-x37mCGA-pp9g-q3vr-p3wfCGA-q93g-w77w-cg4r
Advisory lineage Upstream: 0 Downstream: 53
Modified
Published: 28 Feb 2023, 17:19
Last modified:05 May 2025, 16:12
Vulnerability Summary
Overall Risk (default)
medium
31/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
4.56% LOW
5% probability +4.33%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
28 Feb 2023, 17:19
Published
Vulnerability first disclosed
05 May 2025, 16:12
Last Modified
Vulnerability information updated
Description
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 4.56%• Percentile: 91%
Affected Systems
- chainguard•cadvisor
< 0
- chainguard•dynamic-localpv-provisioner
< 3.4.1-r3
- chainguard•dynamic-localpv-provisioner-fips
< 3.5.0-r0
- chainguard•gke-gcloud-auth-plugin
< 0.0.2-r6
- chainguard•go-1.20
< 1.20.1-r1
- chainguard•grpcurl
< 1.8.7-r7
- chainguard•hey
< 0.1.4-r3
- chainguard•k3d
< 5.6.0-r11
- chainguard•k3d-proxy
< 5.6.0-r11
- chainguard•k3d-tools
< 5.6.0-r11
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kube-state-metrics-2.6
< 2.6.0-r1
- chainguard•kubeflow
< 1.10.0-r4
- chainguard•kubeflow-access-management
< 1.10.0-r4
- chainguard•kubeflow-access-management-compat
< 1.10.0-r4
- chainguard•kubeflow-access-management-fips
< 1.10.0-r2
- chainguard•kubeflow-access-management-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook
< 1.10.0-r4
- chainguard•kubeflow-admission-webhook-compat
< 1.10.0-r4
- chainguard•kubeflow-admission-webhook-fips
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller
< 1.10.0-r4
- chainguard•kubeflow-notebook-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-notebook-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-profile-controller
< 1.10.0-r4
- chainguard•kubeflow-profile-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-profile-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-profile-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller
< 1.10.0-r4
- chainguard•kubeflow-pvcviewer-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-pvcviewer-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller
< 1.10.0-r4
- chainguard•kubeflow-tensorboard-controller-compat
< 1.10.0-r4
- chainguard•kubeflow-tensorboard-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller-fips-compat
< 1.10.0-r2
- chainguard•oauth2-proxy
< 0
- chainguard•prometheus-postgres-exporter-0.10
< 0
- chainguard•prometheus-stackdriver-exporter
< 0
Showing first 50 affected entries in server-rendered view.
References (43)
- https://go.dev/issue/57855
- https://go.dev/cl/468135
- https://go.dev/cl/468295
- https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
- https://pkg.go.dev/vuln/GO-2023-1571
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/
- https://www.couchbase.com/alerts/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20230331-0010/
- https://nvd.nist.gov/vuln/detail/CVE-2022-41723
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE
- https://vuln.go.dev/ID/GO-2023-1571.json
- https://www.couchbase.com/alerts
- https://access.redhat.com/errata/RHSA-2023:7058
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index
- https://bugzilla.redhat.com/show_bug.cgi?id=2178358
- https://bugzilla.redhat.com/show_bug.cgi?id=2222782
- https://bugzilla.redhat.com/show_bug.cgi?id=2223405
- https://bugzilla.redhat.com/show_bug.cgi?id=2227014
- https://bugzilla.redhat.com/show_bug.cgi?id=2227019
- https://bugzilla.redhat.com/show_bug.cgi?id=2227141
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7058.json
- https://access.redhat.com/security/cve/CVE-2022-41723
- https://www.cve.org/CVERecord?id=CVE-2022-41723
- https://github.com/advisories/GHSA-vvpx-j8f3-3w6h
- https://access.redhat.com/errata/RHSA-2024:0948
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0948.json
- https://security-tracker.debian.org/tracker/CVE-2022-41723
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41723.json