CVE-2022-41717: Excessive Memory Growth in Go Server Accepting HTTP/2 Requests
Summary
CVE-2022-41717: Excessive memory growth in net/http and golang.org/x/net/http2. Affects golang across 2 version ranges.
< 1.18.9
>= 1.19.0, < 1.19.4
Fixed in 1.18.9 or 1.19.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang.org/x/net/http2 · Go
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-41717 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language, commonly referred to as Golang, is an open-source programming language developed by Google. It is known for its simplicity, efficiency, and strong support for concurrent programming. Go is widely used for building server-side applications, network services, and distributed systems. However, a vulnerability has been discovered in Go servers that accept HTTP/2 requests.
Vulnerability Detail
The vulnerability, identified as CVE-2022-41717, allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. Although the total number of entries in this cache is limited, an attacker can exploit the server by sending very large keys, leading to the allocation of approximately 64 MiB per open connection. This can result in memory exhaustion and potential denial-of-service (DoS) attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.18.91.18.9 -
>= 1.19.0, < 1.19.41.19.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the maximum size of HTTP header keys in your Go server configuration. By setting a reasonable limit, you can prevent attackers from exploiting the vulnerability. Here is an example of how to set the maximum header key size to 4096 bytes in a Go server:
import (
"net/http"
"golang.org/x/net/http2"
)
func main() {
http2.MaxHeaderBytes = 4096
// Start your Go server
}
Conclusion
In conclusion, the CVE-2022-41717 vulnerability in Go servers accepting HTTP/2 requests can lead to excessive memory growth and potential denial-of-service attacks. It is crucial to update the affected Go package to the recommended versions or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows an attacker to cause excessive memory growth in a Go server, potentially leading to memory exhaustion and denial-of-service (DoS) attacks.
The vulnerability affects versions 0.0.0 to 1.18.8 and versions 1.19.0 to 1.19.3 of the Go package.
At the time of this report, there are no known public exploits targeting this vulnerability.
Yes, updating the affected Go package to version 1.18.9 or later, or version 1.19.4 or later, will fix the vulnerability.
Yes, you can apply a temporary workaround by limiting the maximum size of HTTP header keys in your Go server configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
