PT-2023-14021 · Google+1 · Golang.Org/X/Net/Http2/H2C+1

John Howard · Published 2023-01-13 · Updated 2025-04-04 · CVE-2022-41721

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions golang.org/x/net/http2/h2c (affected versions not specified)

Description A request smuggling attack is possible when using MaxBytesHandler. The body of an HTTP request is not fully consumed, and when the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request. This could be attacker-manipulated to represent arbitrary HTTP2 requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

AZL-13029

CVE-2022-41721

ECHO-FC94-9D86-65B0

GHSA-FXG5-WQ6X-VR4W

GO-2023-1495

OPENSUSE-SU-2024:12666-1

Affected Products

Astra Linux

Golang.Org/X/Net/Http2/H2C

References · 17

• 🔥 https://go.dev/issue/56352 · Exploit
• https://osv.dev/vulnerability/GO-2023-1495 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-13029 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxg5-wq6x-vr4w · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41721 · Security Note
• https://pkg.go.dev/vuln/GO-2023-1495 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12666-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41721 · Vendor Advisory
• https://go.dev/cl/447396 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41721 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41721 · Vendor Advisory
• https://t.me/cvenotify/117767 · Telegram Post
• https://cs.opensource.google/go/x/net · Note