GHSA-vc3p-29h2-gpcp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vc3p-29h2-gpcp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vc3p-29h2-gpcp/GHSA-vc3p-29h2-gpcp.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vc3p-29h2-gpcp
- Aliases
- Published
- 2022-01-02T00:00:48Z
- Modified
- 2023-12-06T00:46:40.271185Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- golang.org/x/net/http2 allows uncontrolled memory consumption
- Details
-
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2021-44716
- https://go.dev/cl/369794
- https://go.dev/issue/50058
- https://groups.google.com/g/golang-announce/c/hcmEScgc00k
- https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
- https://pkg.go.dev/vuln/GO-2022-0288
- https://security.gentoo.org/glsa/202208-02
- https://security.netapp.com/advisory/ntap-20220121-0002
Affected packages
Go / golang.org/x/net/http2
Package
- Name
- golang.org/x/net/http2
- View open source insights on deps.dev
- Purl
- pkg:golang/golang.org/x/net/http2