Read the docs
TI-2022-10644 Aliases CVE-2022-27664GHSA-69cg-p879-7622

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of…

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 25 fixed, 27 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Why it matters now

EPSS 0.03487 89th percentileScored 2026-11-07
Fix Partial golang.org/x/net (Go): 0.0.0-20220906165146-f3363e06e74cgolang.org/x/net/http2 (Go): 0.0.0-20220906165146-f3363e06e74cRed Hat: 38 advisoriesRed Hat: 25 fixed, 27 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—golang.org/x/net (Go)before 0.0.0-20220906165146-f3363e06e74c0.0.0-20220906165146-f3363e06e74cPatch availableGHSA-69cg-p879-7622
—golang.org/x/net/http2 (Go)before 0.0.0-20220906165146-f3363e06e74c0.0.0-20220906165146-f3363e06e74cPatch availableGHSA-69cg-p879-7622
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • golang.org/x/net (Go) Vendor— Affected before 0.0.0-20220906165146-f3363e06e74c Fixed in 0.0.0-20220906165146-f3363e06e74c Patch available GHSA-69cg-p879-7622
  • golang.org/x/net/http2 (Go) Vendor— Affected before 0.0.0-20220906165146-f3363e06e74c Fixed in 0.0.0-20220906165146-f3363e06e74c Patch available GHSA-69cg-p879-7622

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.18.6VulnerableGo standard library
cpe:2.3:a:golang:go:1.19.0:*:*:*:*:*:*:*1.19.0VulnerableGo standard library
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.18.6 Vulnerable ·Go standard library
  • cpe:2.3:a:golang:go:1.19.0:*:*:*:*:*:*:* Versions 1.19.0 Vulnerable ·Go standard library
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-69cg-p879-7622 golang.org/x/net (Go) Fixed in 0.0.0-20220906165146-f3363e06e74c Advisory →
  • Fix · GHSA-69cg-p879-7622 golang.org/x/net/http2 (Go) Fixed in 0.0.0-20220906165146-f3363e06e74c Advisory →

Red Hat 38 advisories

  • RHSA-2024:2944 Released 2024-05-21 · Red Hat rating Important
    AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
    • Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
  • RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderate
    container-tools:4.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
  • RHSA-2023:5009 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
    • Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
Show 35 more Red Hat advisories
  • RHSA-2023:4734 Released 2023-08-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.10 security update
    • Red Hat OpenShift Container Platform 4.13 openshift-clients-4.13.0-202308112024.p0.g17b7acc.assembly.stream.el8, openshift-clients-4.13.0-202308112024.p0.g17b7acc.assembly.stream.el9, openshift-clients-redistributable-4.13.0-202308112024.p0.g17b7acc.assembly.stream.el8 +1
  • RHSA-2023:4674 Released 2023-08-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.30 packages and security update
    • Red Hat OpenShift Container Platform 4.12 openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8, openshift-clients-4.12.0-202308151125.p0.gf61957e.assembly.stream.el9, openshift-clients-redistributable-4.12.0-202308151125.p0.gf61957e.assembly.stream.el8 +1
  • RHSA-2023:3613 Released 2023-06-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.22 packages and security update
    • Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
  • RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 6.1 Container security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2023:0584 Released 2023-05-18 · Red Hat rating Moderate
    Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2023:3205 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
  • RHSA-2023:3204 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.0 RPMs security and bug fix update
    • CNV 4.13 for RHEL 7 kubevirt-4.13.0-1469.el7, kubevirt-virtctl-4.13.0-1469.el7, kubevirt-virtctl-redistributable-4.13.0-1469.el7
    • CNV 4.13 for RHEL 8 kubevirt-4.13.0-1469.el8, kubevirt-virtctl-4.13.0-1469.el8, kubevirt-virtctl-redistributable-4.13.0-1469.el8
    • CNV 4.13 for RHEL 9 kubevirt-4.13.0-1469.el9, kubevirt-virtctl-4.13.0-1469.el9, kubevirt-virtctl-redistributable-4.13.0-1469.el9
  • RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
  • RHSA-2023:2780 Released 2023-05-16 · Red Hat rating Moderate
    Image Builder security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-75-1.el8, osbuild-composer-core-75-1.el8, osbuild-composer-dnf-json-75-1.el8 +2
  • RHSA-2023:2784 Released 2023-05-16 · Red Hat rating Moderate
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-4.el8
  • RHSA-2023:2785 Released 2023-05-16 · Red Hat rating Moderate
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-3.2.0-3.el8
  • RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
  • RHSA-2023:2204 Released 2023-05-09 · Red Hat rating Moderate
    Image Builder security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-76-2.el9_2, osbuild-composer-core-76-2.el9_2, osbuild-composer-dnf-json-76-2.el9_2 +2
  • RHSA-2023:2177 Released 2023-05-09 · Red Hat rating Moderate
    grafana-pcp security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-5.1.1-1.el9
  • RHSA-2023:2236 Released 2023-05-09 · Red Hat rating Moderate
    toolbox security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.3-9.el9, toolbox-tests-0.0.99.3-9.el9
  • RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
  • RHSA-2023:2193 Released 2023-05-09 · Red Hat rating Moderate
    butane security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) butane-0.16.0-1.el9
  • RHSA-2023:2167 Released 2023-05-09 · Red Hat rating Moderate
    grafana security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.0.9-2.el9
  • RHSA-2023:1529 Released 2023-03-30 · Red Hat rating Moderate
    Service Telemetry Framework 1.5 security update
    • Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
  • RHSA-2023:1275 Released 2023-03-15 · Red Hat rating Important
    Red Hat OpenStack Platform (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
  • RHSA-2023:1042 Released 2023-03-06 · Red Hat rating Moderate
    Custom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
  • RHSA-2023:0709 Released 2023-02-09 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.27.0
    • Red Hat OpenShift Serverless 1.27 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
  • RHSA-2023:0708 Released 2023-02-09 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.27.0
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.6.1-1.el8
  • RHSA-2023:0693 Released 2023-02-09 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
  • RHSA-2023:0542 Released 2023-01-30 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.3.1 Containers security update
    • RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4
  • RHSA-2023:0446 Released 2023-01-25 · Red Hat rating Moderate
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.src::go-toolset:rhel8, delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.x86_64::go-toolset:rhel8, go-toolset-1.18.9-1.module+el8.7.0+17845+708ebe87.aarch64::go-toolset:rhel8 +18
  • RHSA-2023:0328 Released 2023-01-23 · Red Hat rating Moderate
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) golang-1.18.9-1.el9_1, golang-bin-1.18.9-1.el9_1, golang-docs-1.18.9-1.el9_1 +4
  • RHSA-2023:0264 Released 2023-01-19 · Red Hat rating Moderate
    Red Hat OpenShift (Logging Subsystem) security update
    • RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
  • RHSA-2022:7398 Released 2023-01-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.0 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
    • Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
  • RHSA-2022:8781 Released 2022-12-08 · Red Hat rating Moderate
    Logging Subsystem 5.5.5 - Red Hat OpenShift security update
    • RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
  • RHSA-2022:8626 Released 2022-11-28 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.17 packages and security update
    • Red Hat OpenShift Container Platform 4.11 cri-o-1.24.3-6.rhaos4.11.gitc4567c0.el8, cri-tools-1.24.2-7.el8, ignition-2.14.0-5.rhaos4.11.el8 +1
  • RHSA-2022:8634 Released 2022-11-28 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.1.1 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-velero-rhel8
  • RHSA-2022:8535 Released 2022-11-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.16 security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2022:7129 Released 2022-10-25 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) git-lfs-2.13.3-3.el8_6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Application Interconnect 1.0AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet: Fix deferred
Self Node Remediation OperatorAffectedNo fix yet
Service Telemetry Framework 1.4 for RHEL 8AffectedNo fix planned: Will not fix
8Base-OADP-1.1Fixed RHSA-2022:8634
8Base-RHMTC-1.7Fixed RHSA-2023:0693
CNV 4.13 for RHEL 7Fixed RHSA-2023:3204
CNV 4.13 for RHEL 8Fixed RHSA-2023:3204
CNV 4.13 for RHEL 9Fixed RHSA-2023:3204, RHSA-2023:3205
Middleware Containers for OpenShiftFixed RHSA-2024:2944
OSSO 1.1 for RHEL 8Fixed RHSA-2023:0584
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2023:1042
Quay v3Fixed—
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
RHOL 5.5 for RHEL 8Fixed RHSA-2022:8781
RHOL 5.6 for RHEL 8Fixed RHSA-2023:0264
RHOSSM 2.3 for RHEL 8Fixed RHSA-2023:0542
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:3642
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7129, RHSA-2023:0446, RHSA-2023:2758, RHSA-2023:2780, RHSA-2023:2784, RHSA-2023:2785, RHSA-2023:2802, RHSA-2024:0121
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0328, RHSA-2023:2167, RHSA-2023:2177, RHSA-2023:2193, RHSA-2023:2204, RHSA-2023:2236, RHSA-2023:2357
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2022:8535, RHSA-2022:8626
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2022:7398, RHSA-2023:3613, RHSA-2023:4674
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:4734
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5009
Red Hat OpenShift Serverless 1.0Fixed RHSA-2023:0708
Red Hat OpenShift Serverless 1.27Fixed RHSA-2023:0709
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:1275
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:1275
Service Telemetry Framework 1.5 for RHEL 8Fixed RHSA-2023:1529
Not affected: 24 products
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • CNV 4.13 for RHEL 9
  • Ironic content for Red Hat OpenShift Container Platform 4.11
  • Ironic content for Red Hat OpenShift Container Platform 4.12
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Ironic content for Red Hat OpenShift Container Platform 4.14
  • Middleware Containers for OpenShift
  • OSSO 1.1 for RHEL 8
  • OpenShift Custom Metrics Autoscaler 2
  • RHODF 4.13 for RHEL 9
  • RHOL 5.5 for RHEL 8
  • RHOL 5.6 for RHEL 8
  • RHOSSM 2.3 for RHEL 8
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Service Telemetry Framework 1.5 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27664
  2. 2026-10-03 Alias added: GHSA-69cg-p879-7622

References

Advisory 7

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences