PT-2022-7291 · Go+11 · Net/Http+11
Josselin Costanzi
·
Published
2022-11-30
·
Updated
2026-03-26
·
CVE-2022-41717
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
net/http versions prior to the fixed version
Description
The issue is related to the net/http package in the Go programming language, which is vulnerable to excessive memory growth due to unbounded resource allocation. An attacker can cause this growth by sending very large HTTP header keys, allowing them to allocate approximately 64 MiB per open connection. This can lead to a denial of service.
Recommendations
For net/http versions prior to the fixed version, consider limiting the canonical header cache by bytes, not entries, to prevent excessive memory growth. As a temporary workaround, restrict the size of HTTP header keys sent by clients to minimize the risk of exploitation.
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Net/Http