Read the docs
TI-2021-20237 Aliases CVE-2021-44716GHSA-vc3p-29h2-gpcp

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory…

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 19 fixed, 14 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Why it matters now

EPSS 0.04254 91st percentileScored 2026-11-07
Fix Partial golang.org/x/net/http2 (Go): 0.0.0-20211209124913-491a49abca63Red Hat: 25 advisoriesRed Hat: 19 fixed, 14 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—golang.org/x/net/http2 (Go)before 0.0.0-20211209124913-491a49abca630.0.0-20211209124913-491a49abca63Patch availableGHSA-vc3p-29h2-gpcp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • golang.org/x/net/http2 (Go) Vendor— Affected before 0.0.0-20211209124913-491a49abca63 Fixed in 0.0.0-20211209124913-491a49abca63 Patch available GHSA-vc3p-29h2-gpcp

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.16.12; 1.17.0 to before 1.17.5VulnerableGo standard library
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.16.12; 1.17.0 to before 1.17.5 Vulnerable ·Go standard library
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:cloud_insights_telegraf:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-vc3p-29h2-gpcp golang.org/x/net/http2 (Go) Fixed in 0.0.0-20211209124913-491a49abca63 Advisory →

Red Hat 25 advisories

  • RHSA-2023:0408 Released 2023-01-25 · Red Hat rating Important
    OpenShift Virtualization 4.12.0 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
  • RHSA-2023:0407 Released 2023-01-24 · Red Hat rating Moderate
    OpenShift Virtualization 4.12.0 RPMs security update
    • CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
    • CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
  • RHSA-2022:6526 Released 2022-09-14 · Red Hat rating Important
    OpenShift Virtualization 4.11.0 Images security and bug fix update
    • CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
Show 22 more Red Hat advisories
  • RHSA-2022:1734 Released 2022-05-05 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.1 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-velero-rhel8
  • RHSA-2022:1628 Released 2022-04-27 · Red Hat rating Important
    web-admin-build security update
    • Red Hat Gluster 3.5 Web Administration on RHEL-7 etcd-3.3.23-9.el7rhgs, grafana-5.2.4-5.el7rhgs
  • RHSA-2022:1372 Released 2022-04-13 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.10.0 enhancement, security & bug fix update
    • RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +21
  • RHSA-2022:1361 Released 2022-04-13 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.10.0 RPM security,enhancement&bugfix update
    • RHODF 4.10 for RHEL 8 mcg-5.10.0-72.el8, mcg-redistributable-5.10.0-72.el8
  • RHSA-2022:1056 Released 2022-03-24 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.21.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.0.0-2.el8
  • RHSA-2022:1051 Released 2022-03-24 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.21.0
    • Red Hat OpenShift Serverless 1.21 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +31
  • RHSA-2022:0927 Released 2022-03-21 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.5 packages and security update
    • Red Hat OpenShift Container Platform 4.10 containernetworking-plugins-0.9.1-2.rhaos4.10.el8, runc-3:1.1.0-2.rhaos4.10.el8
  • RHSA-2022:0947 Released 2022-03-16 · Red Hat rating Moderate
    OpenShift Virtualization 4.10.0 Images security and bug fix update
    • CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
  • RHSA-2022:0855 Released 2022-03-14 · Red Hat rating Moderate
    OpenShift sandboxed containers 1.2.0 security update
    • OpenShift Sandboxed Containers 1.2.0 openshift-sandboxed-containers/osc-rhel8-operator
  • RHSA-2022:0842 Released 2022-03-14 · Red Hat rating Important
    Release of containers for OSP 16.2 director operator tech preview
    • Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-downloader, rhosp-rhel8-tech-preview/osp-director-operator
  • RHSA-2022:0056 Released 2022-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.3 security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2022:0055 Released 2022-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.10 coreos-installer-0.12.0-1.rhaos4.10.el8, coreos-installer-bootinfra-0.12.0-1.rhaos4.10.el8, cri-o-1.23.0-92.rhaos4.10.gitdaab4d1.el7 +11
  • RHSA-2022:0557 Released 2022-02-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.22 security update
    • Red Hat OpenShift Container Platform 4.9 butane-0.13.1-2.rhaos4.9.el8, butane-redistributable-0.13.1-2.rhaos4.9.el8, cri-o-1.22.1-17.rhaos4.9.git3029b1d.2.el8 +14
  • RHSA-2022:0587 Released 2022-02-21 · Red Hat rating Important
    Service Telemetry Framework 1.3 (sg-core-container) security update
    • Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8
  • RHSA-2022:0585 Released 2022-02-21 · Red Hat rating Important
    Service Telemetry Framework 1.4 (sg-core-container) security update
    • Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
  • RHSA-2022:0260 Released 2022-01-25 · Red Hat rating Important
    Red Hat OpenStack Platform 16.1 (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-7.el8ost
  • RHSA-2022:0237 Released 2022-01-24 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-7.el8ost
  • RHSA-2022:0163 Released 2022-01-18 · Red Hat rating Important
    Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-20-tech-preview/cryostat-operator-bundle, cryostat-20-tech-preview/cryostat-rhel8-operator
  • RHSA-2022:0002 Released 2022-01-03 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) grafana-7.3.6-4.el8_4
  • RHSA-2022:0001 Released 2022-01-03 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.9-5.el8_5
  • RHSA-2021:5176 Released 2021-12-16 · Red Hat rating Important
    go-toolset-1.16 and go-toolset-1.16-golang security and bug fix update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.16-1.16.12-1.el7_9, go-toolset-1.16-build-1.16.12-1.el7_9, go-toolset-1.16-golang-1.16.12-1.el7_9 +8
  • RHSA-2021:5160 Released 2021-12-15 · Red Hat rating Important
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.src::go-toolset:rhel8, delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64::go-toolset:rhel8, go-toolset-1.16.12-1.module+el8.5.0+13637+960c7771.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for ContainersAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Virtualization 2AffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Service Telemetry Framework 1.2 for RHEL 8AffectedNo fix yet
8Base-RHMTC-1.7Fixed RHSA-2022:1734
CNV 4.12 for RHEL 7Fixed RHSA-2023:0407
CNV 4.12 for RHEL 8Fixed RHSA-2023:0407, RHSA-2023:0408
CNV 4.9 for RHEL 8Fixed—
Cryostat 2 on RHEL 8Fixed RHSA-2022:0163
OpenShift Sandboxed Containers 1.2.0Fixed RHSA-2022:0855
RHODF 4.10 for RHEL 8Fixed RHSA-2022:1361, RHSA-2022:1372
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:5176
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:5160, RHSA-2022:0001
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0002
Red Hat Gluster 3.5 Web Administration on RHEL-7Fixed RHSA-2022:1628
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0055, RHSA-2022:0056, RHSA-2022:0927
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2022:0557
Red Hat OpenShift Serverless 1.0Fixed RHSA-2022:1056
Red Hat OpenShift Serverless 1.21Fixed RHSA-2022:1051
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:0260
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:0237, RHSA-2022:0842
Service Telemetry Framework 1.3 for RHEL 8Fixed RHSA-2022:0587
Service Telemetry Framework 1.4 for RHEL 8Fixed RHSA-2022:0585
Not affected: 11 products
  • 8Base-RHMTC-1.7
  • CNV 4.12 for RHEL 8
  • CNV 4.9 for RHEL 8
  • OpenShift Sandboxed Containers 1.2.0
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenShift on AWS
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44716
  2. 2026-10-03 Alias added: GHSA-vc3p-29h2-gpcp

References

Patch 1

Advisory 5

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences