CVE-2022-27664: Denial of Service in net/http and golang.org/x/net/http2
Summary
CVE-2022-27664: Denial of service in net/http and golang.org/x/net/http2. Affects stdlib across 2 version ranges.
< 1.18.6
>= 1.19.0-0, < 1.19.1
Fixed in 1.18.6 or 1.19.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang.org/x/net · Go
- golang.org/x/net · Go
- golang-1.15 · Debian:11
The same CVE-2022-27664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is the Go standard library (stdlib) and the golang.org/x/net package. The Go standard library provides a set of packages for building Go applications, including the net/http package for HTTP server and client implementations. The golang.org/x/net package contains additional networking libraries, including the http2 package for HTTP/2 support. These packages are widely used in Go applications for handling HTTP communication.
Vulnerability Detail
The vulnerability (CVE-2022-27664) allows a malicious client to cause a denial of service (DoS) by exploiting a flaw in the handling of HTTP/2 server connections. When a fatal error occurs during a clean shutdown of an HTTP/2 server connection, the connection can hang indefinitely, preventing the server from properly terminating the connection. This can be exploited by a malicious client to exhaust server resources and cause a DoS condition.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.61.18.6go get stdlib@v1.18.6 -
>= 1.19.0-0, < 1.19.11.19.1go get stdlib@v1.19.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of the affected packages.
Conclusion
The vulnerability (CVE-2022-27664) in the net/http and golang.org/x/net/http2 packages allows a malicious client to cause a denial of service by exploiting a flaw in the handling of HTTP/2 server connections. To fix the vulnerability, developers should update their Go installations to versions 1.18.6 or 1.19.1. There is no known workaround for this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows a malicious client to cause a denial of service by exploiting a flaw in the handling of HTTP/2 server connections. This can lead to server resource exhaustion and unavailability.
The vulnerability affects the net/http and golang.org/x/net/http2 packages in Go.
No, only versions prior to 1.18.6 and 1.19.1 of the affected packages are vulnerable. Updating to these versions fixes the vulnerability.
No, there is no known workaround. It is recommended to update to the fixed versions of the affected packages.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
