Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
Priority HIGH 72CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01816 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial golang.org/x/net/http2/h2c (golang.org/x/net): 0.1.1-0.20221104162952-702349b0e862golang.org/x/net (Go): 0.1.1-0.20221104162952-702349b0e862Red Hat: 2 advisoriesRed Hat: 2 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/net/http2/h2c | 0.0.0-20220524220425-1d687d428aca to before 0.1.1-0.20221104162952-702349b0e862 | 0.1.1-0.20221104162952-702349b0e862 | Patch available | CNA |
| — | golang.org/x/net (Go) | 0.0.0-20220524220425-1d687d428aca to before 0.1.1-0.20221104162952-702349b0e862 | 0.1.1-0.20221104162952-702349b0e862 | Patch available | GHSA-fxg5-wq6x-vr4w |
- golang.org/x/net/http2/h2c VendorGo standard library Affected 0.0.0-20220524220425-1d687d428aca to before 0.1.1-0.20221104162952-702349b0e862 Fixed in 0.1.1-0.20221104162952-702349b0e862 Patch available CNA
- golang.org/x/net (Go) Vendor— Affected 0.0.0-20220524220425-1d687d428aca to before 0.1.1-0.20221104162952-702349b0e862 Fixed in 0.1.1-0.20221104162952-702349b0e862 Patch available GHSA-fxg5-wq6x-vr4w
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:h2c:*:*:*:*:*:go:*:* | before 2022-11-04 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:h2c:*:*:*:*:*:go:*:* Versions before 2022-11-04 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/net/http2/h2c (golang.org/x/net) Fixed in 0.1.1-0.20221104162952-702349b0e862
- Fix · GHSA-fxg5-wq6x-vr4w golang.org/x/net (Go) Fixed in 0.1.1-0.20221104162952-702349b0e862 Advisory →
Red Hat 2 advisories
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
- RHSA-2023:1326 Released 2023-05-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1326 |
Not affected: 4 products
- MTA 6.2 for RHEL 8
- OpenShift Pipelines
- Red Hat Advanced Cluster Security 3
- Red Hat OpenShift Container Platform 4.13
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41721
- 2026-10-03 Alias added: GHSA-fxg5-wq6x-vr4w
References
Exploit 1
Patch 1
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/
- https://cs.opensource.google/go/x/net
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP
Sources
- CVE-2022-41721 · CVE Program
- CVE-2022-41721 · NVD
- FIRST EPSS
- GHSA-fxg5-wq6x-vr4w · GitHub Advisory Database · CC BY 4.0
- CVE-2022-41721 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences