CVE-2022-41717: Excessive memory growth in net/http and golang.org/x/net/http2
Summary
CVE-2022-41717: Excessive memory growth in net/http and golang.org/x/net/http2. Affects stdlib across 2 version ranges.
< 1.18.9
>= 1.19.0-0, < 1.19.4
Fixed in 1.18.9 or 1.19.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang.org/x/net/http2 · Go
- golang-1.15 · Debian:11
The same CVE-2022-41717 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted packages in this vulnerability are the standard library (stdlib) and golang.org/x/net in the Go ecosystem. The stdlib package provides core functionality for Go programs, including networking capabilities. The golang.org/x/net package contains additional networking utilities. Both packages are widely used in Go applications. This vulnerability affects the HTTP/2 server connections in these packages.
Vulnerability Detail
An attacker can exploit this vulnerability by sending very large keys in HTTP/2 requests to a Go server. The server maintains a cache of HTTP header keys sent by the client. While the total number of entries in this cache is limited, an attacker can cause the server to allocate approximately 64 MiB of memory per open connection. This excessive memory growth can lead to resource exhaustion and potential denial-of-service (DoS) attacks.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.91.18.9go get stdlib@v1.18.9 -
>= 1.19.0-0, < 1.19.41.19.4go get stdlib@v1.19.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the packages to the fixed versions.
Conclusion
This vulnerability affects the net/http and golang.org/x/net packages in the Go ecosystem, specifically the HTTP/2 server connections. It allows an attacker to cause excessive memory growth, potentially leading to denial-of-service attacks. To mitigate this vulnerability, it is crucial to update the impacted packages to the fixed versions. For further assistance, contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can lead to excessive memory consumption in Go servers, potentially causing resource exhaustion and denial-of-service (DoS) attacks.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will alert you in real-time if your application is vulnerable.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the packages to prevent potential exploitation.
No, this vulnerability requires a code fix in the impacted packages. Configuration changes alone cannot mitigate the issue.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
