GO-2022-0288
Unbounded memory growth in net/http and golang.org/x/net/http2
At a glance
- Published
- Updated
- CVE
- CVE-2021-44716
- Aliases
- BIT-golang-2021-44716, GHSA-vc3p-29h2-gpcp
Description
An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.16.12, introduced 1.17.0-0, fixed 1.17.5 |
| Go · golang.org/x/net | introduced 0, fixed 0.0.0-20211209124913-491a49abca63 |
References
- https://go.dev/cl/369794 FIX
- https://go.dev/issue/50058 REPORT
- https://groups.google.com/g/golang-announce/c/hcmEScgc00k WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |