CVE-2022-27664: Denial of Service Vulnerability in golang
Summary
CVE-2022-27664: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. Affects golang across 2 version ranges.
< 1.18.6
>= 1.19.0, < 1.19.1
Fixed in 1.18.6 or 1.19.1, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
- golang.org/x/net · Go
- golang.org/x/net · Go
- golang-1.15 · Debian:11
The same CVE-2022-27664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The golang package is a popular open-source programming language that provides a robust set of tools and libraries for building scalable and efficient applications. It is widely used in various domains, including web development, network programming, and system administration. However, a vulnerability has been discovered in versions before 1.18.6 and 1.19.x before 1.19.1 that can lead to a denial of service (DoS) attack. This vulnerability affects the HTTP/2 functionality of the package and can cause an HTTP/2 connection to hang during closing if shutdown is preempted by a fatal error.
Vulnerability Detail
The vulnerability (CVE-2022-27664) in the golang package allows attackers to exploit the HTTP/2 functionality, leading to a DoS condition. By triggering a fatal error during the shutdown process of an HTTP/2 connection, an attacker can cause the connection to hang indefinitely, preventing further communication and potentially exhausting server resources. This vulnerability can be exploited remotely without authentication, making it a significant security concern for applications utilizing the affected versions of the golang package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.18.61.18.6 -
>= 1.19.0, < 1.19.11.19.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable the HTTP/2 functionality in their applications if it is not essential. By disabling HTTP/2, the vulnerability can be mitigated until the package is updated to a fixed version. However, it is important to note that disabling HTTP/2 may impact the performance and capabilities of the application, so it should be carefully evaluated before implementing.
Conclusion
The golang package is susceptible to a denial of service vulnerability in versions before 1.18.6 and 1.19.x before 1.19.1. This vulnerability can be exploited remotely without authentication, potentially leading to resource exhaustion and disruption of affected applications. To mitigate this vulnerability, it is crucial to update the golang package to the recommended versions or apply the temporary workaround of disabling HTTP/2 functionality. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows attackers to cause a denial of service (DoS) condition by hanging an HTTP/2 connection during closing. This can lead to resource exhaustion and disrupt the normal operation of affected applications.
Yes, this vulnerability can be exploited remotely without authentication, making it a significant security concern for applications utilizing the affected versions of the golang package.
No, only versions before 1.18.6 and 1.19.x before 1.19.1 are affected. It is recommended to update to the latest version to mitigate the vulnerability.
Yes, developers can temporarily disable the HTTP/2 functionality in their applications as a workaround until the package is updated. However, this may impact the application's performance and capabilities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
