Read the docs
TI-2022-20114 Aliases CVE-2022-41723GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Priority MEDIUM 46CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 29 fixed, 32 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04561 91st percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.19.6, 1.20.1golang.org/x/net/http2 (golang.org/x/net): 0.7.0+2 more productsRed Hat: 57 advisoriesRed Hat: 29 fixed, 32 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/httpbefore 1.19.6; 1.20.0-0 to before 1.20.11.19.6, 1.20.1Patch availableCNA
Go standard librarygolang.org/x/net/http2before 0.7.00.7.0Patch availableCNA
Go standard librarygolang.org/x/net/http2/hpackbefore 0.7.00.7.0Patch availableCNA
—golang.org/x/net (Go)before 0.7.00.7.0Patch availableGHSA-vvpx-j8f3-3w6h
  • net/http VendorGo standard library Affected before 1.19.6; 1.20.0-0 to before 1.20.1 Fixed in 1.19.6, 1.20.1 Patch available CNA
  • golang.org/x/net/http2 VendorGo standard library Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA
  • golang.org/x/net/http2/hpack VendorGo standard library Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA
  • golang.org/x/net (Go) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-vvpx-j8f3-3w6h

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.19.6VulnerableGo standard library
cpe:2.3:a:golang:go:1.20.0:-:*:*:*:*:*:*1.20.0VulnerableGo standard library
cpe:2.3:a:golang:hpack:*:*:*:*:*:go:*:*before 0.7.0VulnerableGo standard library
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*before 0.7.0VulnerableGo standard library

Remediation

  • Fix · CNA net/http (Go standard library) Fixed in 1.19.6, 1.20.1
  • Fix · CNA golang.org/x/net/http2 (golang.org/x/net) Fixed in 0.7.0
  • Fix · CNA golang.org/x/net/http2/hpack (golang.org/x/net) Fixed in 0.7.0
  • Fix · GHSA-vvpx-j8f3-3w6h golang.org/x/net (Go) Fixed in 0.7.0 Advisory →

Red Hat 57 advisories

  • RHSA-2025:1116 Released 2025-02-13 · Red Hat rating Important
    OpenShift Container Platform 4.13.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-baremetal-machine-controllers, openshift4/ose-ibmcloud-machine-controllers-rhel8, openshift4/ose-nutanix-cloud-controller-manager-rhel8 +4
  • RHSA-2024:4677 Released 2024-07-25 · Red Hat rating Important
    OpenShift Container Platform 4.12.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-operator-lifecycle-manager +1
  • RHSA-2024:3494 Released 2024-06-05 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.43 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8
Show 54 more Red Hat advisories
  • RHSA-2024:2944 Released 2024-05-21 · Red Hat rating Important
    AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
    • Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
  • RHSA-2024:0948 Released 2024-02-28 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.35 security update
    • Red Hat OpenShift Container Platform 4.13 podman-3:4.4.1-5.1.rhaos4.13.el8, podman-3:4.4.1-6.1.1.rhaos4.13.el9, podman-catatonit-3:4.4.1-5.1.rhaos4.13.el8 +10
  • RHSA-2024:0485 Released 2024-01-31 · Red Hat rating Important
    OpenShift Container Platform 4.12.48 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:0198 Released 2024-01-17 · Red Hat rating Important
    OpenShift Container Platform 4.12.47 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-k8s-prometheus-adapter, openshift4/ose-machine-api-provider-aws-rhel8 +1
  • RHSA-2023:7823 Released 2024-01-04 · Red Hat rating Important
    OpenShift Container Platform 4.12.46 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-azure-cloud-node-manager-rhel8, openshift4/ose-cluster-autoscaler-operator, openshift4/ose-cluster-cloud-controller-manager-operator-rhel8 +9
  • RHSA-2023:7058 Released 2023-11-14 · Red Hat rating Moderate
    rhc security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) rhc-1:0.2.4-3.el8_9
  • RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
  • RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
  • RHSA-2023:6832 Released 2023-11-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.14.0 security, enhancement & bug fix update
    • RHODF 4.14 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-cli-rhel9, odf4/mcg-core-rhel9 +12
  • RHSA-2023:6346 Released 2023-11-07 · Red Hat rating Moderate
    toolbox security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.4-6.el9_3, toolbox-tests-0.0.99.4-6.el9_3
  • RHSA-2023:6402 Released 2023-11-07 · Red Hat rating Moderate
    containernetworking-plugins security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-4.el9
  • RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderate
    podman security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
  • RHSA-2023:6473 Released 2023-11-07 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-1.el9, buildah-tests-1:1.31.3-1.el9
  • RHSA-2023:6363 Released 2023-11-07 · Red Hat rating Moderate
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-1.el9, skopeo-tests-2:1.13.3-1.el9
  • RHSA-2023:6251 Released 2023-11-01 · Red Hat rating Important
    OpenShift Virtualization 4.11.7 Images security and bug fix update
    • CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
  • RHSA-2023:6248 Released 2023-11-01 · Red Hat rating Important
    OpenShift Virtualization 4.12.8 Images security update
    • CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +37
  • RHSA-2023:6235 Released 2023-11-01 · Red Hat rating Important
    OpenShift Virtualization 4.13.5 Images security update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +39
  • RHSA-2023:5007 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 security update
    • Red Hat OpenShift Container Platform 4.14 openshift-tech-preview/metallb-rhel8, openshift4/cloud-event-proxy-rhel8, openshift4/frr-rhel9 +47
  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2023:5672 Released 2023-10-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.17 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-machine-approver, openshift4/ose-hyperkube, openshift4/ose-ovn-kubernetes +2
  • RHSA-2023:5314 Released 2023-09-20 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.1.6 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8 +5
  • RHSA-2023:5233 Released 2023-09-19 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.4 security and bug fix update
    • CNV 4.13 for RHEL 9 container-native-virtualization/hco-bundle-registry-rhel9
  • RHSA-2023:4731 Released 2023-08-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.10 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-prometheus-node-exporter
  • RHSA-2023:4664 Released 2023-08-16 · Red Hat rating Important
    OpenShift Virtualization 4.13.3 Images security and bug fix update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
  • RHSA-2023:4603 Released 2023-08-16 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-cloud-controller-manager-operator-rhel8, openshift4/ose-vsphere-cloud-controller-manager-rhel8
  • RHSA-2023:4627 Released 2023-08-14 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
  • RHSA-2023:4456 Released 2023-08-08 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.8 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:4421 Released 2023-08-01 · Red Hat rating Important
    OpenShift Virtualization 4.12.5 security and bug fix update
    • CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +40
  • RHSA-2023:4293 Released 2023-07-27 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.11 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
  • RHSA-2023:4226 Released 2023-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.6 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-azure-disk-csi-driver-rhel8, openshift4/ose-azure-file-csi-driver-rhel8 +2
  • RHSA-2023:4225 Released 2023-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.6 security and extras update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-efs-csi-driver-container-rhel8
  • RHSA-2023:4091 Released 2023-07-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.5 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-apiserver-network-proxy-rhel8, openshift4/ose-cluster-kube-cluster-api-rhel8-operator, openshift4/ose-kube-rbac-proxy +1
  • RHSA-2023:4090 Released 2023-07-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.5 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-nfd-operator, openshift4/ose-node-feature-discovery
  • RHSA-2023:4113 Released 2023-07-17 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.3.5 security update
    • RHOSSM 2.3 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2023:4112 Released 2023-07-17 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.8 security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2023:4003 Released 2023-07-10 · Red Hat rating Moderate
    Red Hat Service Interconnect 1.4 Release security update
    • Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
    • Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
  • RHSA-2023:3943 Released 2023-06-29 · Red Hat rating Moderate
    ACS 4.1 enhancement and security update
    • RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
  • RHSA-2023:3918 Released 2023-06-29 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-rhel8
  • RHSA-2023:3612 Released 2023-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.4 packages and security update
    • Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.18.1.el9_2, buildah-1:1.29.1-2.1.rhaos4.13.el9, buildah-1:1.29.1-2.rhaos4.13.el8 +47
  • RHSA-2023:3614 Released 2023-06-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-azure-cluster-api-controllers-rhel8, openshift4/ose-ibm-vpc-node-label-updater-rhel8, openshift4/ose-telemeter
  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
  • RHSA-2023:3537 Released 2023-06-13 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-azure-cloud-node-manager-rhel8, openshift4/ose-cloud-credential-operator +7
  • RHSA-2023:3495 Released 2023-06-12 · Red Hat rating Moderate
    Logging Subsystem 5.7.2 - Red Hat OpenShift security update
    • RHOL 5.7 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/eventrouter-rhel8, openshift-logging/fluentd-rhel8
  • RHSA-2023:3367 Released 2023-06-07 · Red Hat rating Important
    OpenShift Container Platform 4.13.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:3455 Released 2023-06-05 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.29.0
    • Red Hat OpenShift Serverless 1.29 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
  • RHSA-2023:3445 Released 2023-06-05 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-14.el8ost
  • RHSA-2023:3447 Released 2023-06-05 · Red Hat rating Important
    Red Hat OpenStack Platform 16.1 (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-14.el8ost
  • RHSA-2023:3450 Released 2023-06-05 · Red Hat rating Moderate
    OpenShift Serverless Client kn 1.29.0 release
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.8.1-3.el8
  • RHSA-2023:3304 Released 2023-05-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/network-tools-rhel8, openshift4/oc-mirror-plugin-rhel8 +42
  • RHSA-2023:3305 Released 2023-05-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.1 security and extras update
    • Red Hat OpenShift Container Platform 4.13 openshift4/kubernetes-nmstate-rhel8-operator, openshift4/ose-ptp-operator
  • RHSA-2023:3167 Released 2023-05-18 · Red Hat rating Moderate
    Red Hat build of Cryostat 2.3.0: new RHEL 8 container images
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
  • RHSA-2023:1325 Released 2023-05-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
    • Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:3083 Released 2023-05-16 · Red Hat rating Moderate
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.6-1.module+el8.8.0+18289+edd6c8b6.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 6AffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift Secondary Scheduler OperatorAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Application Interconnect 1.0AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Sandboxed ContainersAffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Red Hat Web TerminalAffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet
8Base-MTV-2.4Fixed—
8Base-MTV-2.5Fixed—
8Base-OADP-1.1Fixed RHSA-2023:3918, RHSA-2023:5314
8Base-RHMTC-1.7Fixed RHSA-2023:4293
CNV 4.12 for RHEL 8Fixed RHSA-2023:4421, RHSA-2023:6248
CNV 4.13 for RHEL 9Fixed RHSA-2023:4664, RHSA-2023:5233, RHSA-2023:6235
Cryostat 2 on RHEL 8Fixed RHSA-2023:3167
MTA 6.2 for RHEL 8Fixed RHSA-2023:4627
Middleware Containers for OpenShiftFixed RHSA-2024:2944
OpenShift Developer Tools and Services for OCP 4.12Fixed—
OpenShift Update Service 5.0 for RHEL 8Fixed—
Quay v3Fixed—
RHACS 4.1 for RHEL 8Fixed RHSA-2023:3943
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
RHODF 4.14 for RHEL 9Fixed RHSA-2023:6832
RHOL 5.7 for RHEL 8Fixed RHSA-2023:3495
RHOSSM 2.2 for RHEL 8Fixed RHSA-2023:4112
RHOSSM 2.3 for RHEL 8Fixed RHSA-2023:4113
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:3083, RHSA-2023:6938, RHSA-2023:6939, RHSA-2023:7058
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:6346, RHSA-2023:6363, RHSA-2023:6402, RHSA-2023:6473, RHSA-2023:6474
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:7823, RHSA-2024:0198, RHSA-2024:0485, RHSA-2024:4677
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1325, RHSA-2023:1326, RHSA-2023:3304, RHSA-2023:3305, RHSA-2023:3367, RHSA-2023:3537, RHSA-2023:3614, RHSA-2023:4090, RHSA-2023:4091, RHSA-2023:4225, RHSA-2023:4226, RHSA-2023:4456, RHSA-2023:4603, RHSA-2023:4731, RHSA-2023:5672, RHSA-2024:0948, RHSA-2024:3494, RHSA-2025:1116
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006, RHSA-2023:5007
Red Hat OpenShift Serverless 1.0Fixed RHSA-2023:3450
Red Hat OpenShift Serverless 1.29Fixed RHSA-2023:3455
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:3447
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:3445
Red Hat Service InterconnectFixed RHSA-2023:4003
Red Hat Service Interconnect 1Fixed RHSA-2023:4003
Not affected: 34 products
  • 8Base-MTV-2.4
  • 8Base-MTV-2.5
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • CNV 4.12 for RHEL 8
  • CNV 4.13 for RHEL 9
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Logging Subsystem for Red Hat OpenShift
  • MTA 6.2 for RHEL 8
  • Middleware Containers for OpenShift
  • Network Observability Operator
  • OpenShift Developer Tools and Services
  • OpenShift Developer Tools and Services for OCP 4.12
  • RHACS 4.1 for RHEL 8
  • RHODF 4.13 for RHEL 9
  • RHODF 4.14 for RHEL 9
  • RHOL 5.7 for RHEL 8
  • RHOSSM 2.2 for RHEL 8
  • RHOSSM 2.3 for RHEL 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • Red Hat Satellite 6
  • Red Hat Service Interconnect
  • Red Hat Service Interconnect 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41723
  2. 2026-10-03 Alias added: GHSA-vvpx-j8f3-3w6h
  3. 2026-10-30 Fix available: OpenShift Update Service 5.0 for RHEL 8 · Red Hat

References

Patch 2

Advisory 7

Other 15

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences