Description
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go standard library | net/http | < 1.18.9, 1.19.0-0 – < 1.19.4 | 1.18.9 |
| golang.org/x/net | golang.org/x/net/http2 | < 0.4.0 | 0.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-golang-x-net | 1:0.4.0+dfsg-1 | — |
| Debian 13 | golang-golang-x-net | 1:0.4.0+dfsg-1 | — |
| Debian 12 | golang-1.19 | 1.19.4-1 | — |
| Debian 12 | golang-golang-x-net | 1:0.4.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.2 | USN-6038-2 |
| Ubuntu 22.04 LTS | golang-1.17 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-1.18 | 1.18.1-1ubuntu1.1 | USN-6038-1 |
| Ubuntu 20.04 LTS | golang-1.13 | 1.13.8-1ubuntu1.2 | USN-6038-2 |
| Ubuntu 20.04 LTS | golang-1.14 | No fix yet | — |
| Ubuntu 20.04 LTS | golang-1.16 | 1.16.2-0ubuntu1~20.04.1 | USN-6038-2 |
| Ubuntu 20.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~20.04.2 | USN-6038-1 |
| Ubuntu 18.04 LTS | golang-1.18 | 1.18.1-1ubuntu1~18.04.4 | USN-6038-1 |
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | golang-1.13 | 1.13.8-1ubuntu1~18.04.4+esm1 | USN-6038-2 |
| Ubuntu Pro 18.04 LTS | golang-1.16 | 1.16.2-0ubuntu1~18.04.2+esm1 | USN-6038-2 |
| Ubuntu Pro 16.04 LTS | golang-1.13 | 1.13.8-1ubuntu1~16.04.3+esm3 | USN-6038-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | buildah +1 | 1:1.29.1-1.el9 | RHSA-2023:2253 |
| RHEL 9 | conmon | 2:2.1.7-1.el9_2 | RHSA-2023:2222 |
| RHEL 9 | containernetworking-plugins | 1:1.2.0-1.el9 | RHSA-2023:2367 |
| RHEL 9 | git-lfs | 3.2.0-1.el9 | RHSA-2023:2357 |
| RHEL 9 | golang +6 | 1.18.9-1.el9_1 | RHSA-2023:0328 |
| RHEL 9 | grafana | 9.2.10-7.el9_3 | RHSA-2023:6420 |
| RHEL 9 | osbuild-composer +3 | 76-2.el9_2 | RHSA-2023:2204 |
| RHEL 9 | podman +5 | 2:4.4.1-3.el9 | RHSA-2023:2282 |
| RHEL 9 | skopeo +1 | 2:1.11.2-0.1.el9 | RHSA-2023:2283 |
| RHEL 9 | toolbox +1 | 0.0.99.3-9.el9 | RHSA-2023:2236 |
| RHEL 9 | weldr-client | 35.9-1.el9 | RHSA-2023:2204 |
| RHEL 8 | buildah +1 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | cockpit-podman | 46-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | conmon | 2:2.1.4-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | container-selinux | 2:2.199.0-1.module+el8.8.0+18113+8b5b6979 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | containernetworking-plugins | 1:1.1.1-2.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | containers-common | 2:1-37.module+el8.8.0+17954+9046de88 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | crit +4 | 3.15-3.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | crun | 1.6-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | delve | 1.8.3-1.module+el8.7.0+15126+0e0a42d9 | RHSA-2023:0446 |
| RHEL 8 | fuse-overlayfs | 1.9-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | git-lfs | 3.2.0-2.el8 | RHSA-2023:2866 |
| RHEL 8 | go-toolset | 1.18.9-1.module+el8.7.0+17845+708ebe87 | RHSA-2023:0446 |
| RHEL 8 | golang +6 | 1.18.9-1.module+el8.7.0+17640+84246675 | RHSA-2023:0446 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | netavark +1 | 2:1.0.1-37.module+el8.8.0+17954+9046de88 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.8.0+18083+cd85596b | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | osbuild-composer +3 | 75-1.el8 | RHSA-2023:2780 |
| RHEL 8 | podman +6 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | python-podman +1 | 4.0.0-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | runc | 1:1.1.4-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | skopeo +1 | 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | slirp4netns | 1.1.8-2.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | toolbox +1 | 0.0.99.3-7.module+el8.8.0+18115+45021590 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | udica | 0.2.6-3.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | weldr-client | 35.9-2.el8 | RHSA-2023:2780 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Serverless 1 | openshift-serverless-clients | 1.6.1-2.el8 | RHSA-2023:1179 |
| Red Hat Satellite Utils 6 | foreman +1 | 3.7.0.9-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.7.0.9-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | puppet-agent | 7.26.0-3.el8sat | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.11.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.21-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-future +1 | 0.18.3-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.32-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-pulp-ansible +1 | 1:0.16.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-requests +1 | 2.31.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-sqlparse +1 | 0.4.4-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | rubygem-rack | 2.2.7-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | foreman +13 | 3.7.0.9-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | puppet-agent | 7.26.0-3.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | puppetserver | 7.11.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-django +1 | 3.2.21-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-future +1 | 0.18.3-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-gitpython +1 | 3.1.32-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-pulp-ansible +1 | 1:0.16.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-requests +1 | 2.31.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-sqlparse +1 | 0.4.4-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-actionpack +2 | 6.1.7.3-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-git | 1.18.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-globalid | 1.1.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-kubeclient | 4.10.1-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-rack | 2.2.7-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-1.el8sat | RHSA-2023:6818 |
| Red Hat Rhel Satellite Client 6 | foreman_ygg_worker | 0.2.2-1.el7sat | RHSA-2023:5982 |
| Red Hat Rhel Satellite Client 6 | puppet-agent | 7.26.0-3.el6sat | RHSA-2023:5982 |
| Red Hat Rhel Satellite Client 6 | yggdrasil | 0.2.3-1.el7sat | RHSA-2023:5982 |
| Red Hat Openshift Ironic 4 | python-werkzeug +1 | 2.0.3-4.el9 | RHSA-2023:1325 |
| Red Hat OpenStack 16 | collectd-libpod-stats | 1.0.4-3.el8ost | RHSA-2023:1276 |
| Red Hat OpenStack 16 | etcd | 3.3.23-12.el8ost | RHSA-2023:1275 |
| Red Hat OpenShift 4 | bpftool | 7.0.0-284.18.1.el9_2 | RHSA-2023:3612 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.23.4-3.rhaos4.11.el8 | RHSA-2023:3914, RHSA-2023:3612, RHSA-2023:1325 |
| Red Hat OpenShift 4 | conmon | 3:2.1.7-2.rhaos4.13.el8 | RHSA-2023:3612 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1.0.1-7.rhaos4.13.el8 | RHSA-2023:3612 |
| Red Hat OpenShift 4 | cri-o | 1.26.3-3.rhaos4.13.git641290e.el9 | RHSA-2023:3612, RHSA-2023:1325 |
| Red Hat OpenShift 4 | haproxy +1 | 2.2.24-3.rhaos4.12.el8 | RHSA-2023:1325, RHSA-2023:1268 |
| Red Hat OpenShift 4 | kernel-rt +21 | 5.14.0-284.18.1.rt14.303.el9_2 | RHSA-2023:3612 |
| Red Hat OpenShift 4 | microshift +4 | 4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9 | RHSA-2023:1329 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7 | RHSA-2023:3914, RHSA-2023:3910, RHSA-2023:3612 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8 | RHSA-2023:3914 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | perf +60 | 5.14.0-284.18.1.el9_2 | RHSA-2023:3612 |
| Red Hat OpenShift 4 | podman +5 | 3.2.3-1.1.rhaos4.10.el8 | RHSA-2023:3914, RHSA-2023:3910, RHSA-2023:3612 |
| Red Hat OpenShift 4 | podman-gvproxy | 3:4.4.1-3.rhaos4.13.el8 | RHSA-2023:3612, RHSA-2023:1325 |
| Red Hat OpenShift 4 | python-werkzeug +1 | 1.0.1-3.el8ost | RHSA-2023:1325 |
| Red Hat OpenShift 4 | runc | 3:1.1.2-2.rhaos4.11.el8 | RHSA-2023:3914, RHSA-2023:3612 |
| Red Hat OpenShift 4 | skopeo +2 | 1:1.2.4-1.1.el8 | RHSA-2023:3914, RHSA-2023:3910, RHSA-2023:3612 |
| Red Hat Container Native Virtualization 4 | kubevirt +2 | 4.13.0-1469.el7 | RHSA-2023:3204 |
| Red Hat Ansible Automation Platform 2 | openshift-clients | 4.12.0-202307200611.p0.g49844f7.assembly.stream.el8 | RHSA-2023:4470 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | buildah +1 | 1:1.29.1-1.el9 | ALSA-2023:2253 |
| AlmaLinux 9 | conmon | 2:2.1.7-1.el9_2 | ALSA-2023:2222 |
| AlmaLinux 9 | containernetworking-plugins | 1:1.2.0-1.el9 | ALSA-2023:2367 |
| AlmaLinux 9 | git-lfs | 3.2.0-1.el9 | ALSA-2023:2357 |
| AlmaLinux 9 | grafana | 9.2.10-7.el9_3.alma.1 | ALSA-2023:6420 |
| AlmaLinux 9 | osbuild-composer +3 | 76-2.el9_2.alma | ALSA-2023:2204 |
| AlmaLinux 9 | podman +5 | 2:4.4.1-3.el9 | ALSA-2023:2282 |
| AlmaLinux 9 | skopeo +1 | 2:1.11.2-0.1.el9 | ALSA-2023:2283 |
| AlmaLinux 9 | toolbox +1 | 0.0.99.3-9.el9 | ALSA-2023:2236 |
| AlmaLinux 9 | weldr-client | 35.9-1.el9 | ALSA-2023:2204 |
| AlmaLinux 8 | buildah +1 | 1:1.24.6-5.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | conmon | 2:2.1.4-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | container-selinux | 2:2.199.0-1.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.1.1-2.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | containers-common | 2:1-37.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | crit +4 | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | crun | 1.6-1.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | fuse-overlayfs | 1.9-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | git-lfs | 3.2.0-2.el8 | ALSA-2023:2866 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | netavark +1 | 2:1.0.1-37.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | osbuild-composer +3 | 75-1.el8.alma | ALSA-2023:2780 |
| AlmaLinux 8 | podman +6 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | python3-podman | 4.0.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | runc | 1:1.1.4-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | skopeo +1 | 2:1.6.2-6.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | slirp4netns | 1.1.8-2.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.3-7.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | udica | 0.2.6-3.module_el8.6.0+2886+d33c3efb | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | weldr-client | 35.9-2.el8 | ALSA-2023:2780 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | cockpit-podman | 46-1.module+el8.9.0+1445+07728297 | RLSA-2023:2802 |
| Rocky Linux 8 | criu | 3.15-3.module+el8.9.0+1445+07728297 | RLSA-2023:2802, RLSA-2023:2758 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2023:2802, RLSA-2023:2758 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2023:2802 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| SLES 15 SP4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES 15 SP4 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
| SLES 15 SP3 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| SLES 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLES 15 SP3 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLE Real Time 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SLE HPC 15 SP3 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| SUSE Enterprise Storage 7.1 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.18 | 1.18.9-1.1 | openSUSE-SU-2024:12552-1 |
| openSUSE Tumbleweed | go1.19 | 1.19.4-1.1 | openSUSE-SU-2024:12553-1 |
| openSUSE Tumbleweed | traefik | 2.9.6-1.1 | openSUSE-SU-2024:12615-1 |
| openSUSE Tumbleweed | traefik2 | 2.11.5-1.1 | openSUSE-SU-2024:14076-1 |
| openSUSE Tumbleweed | velero | 1.11.1-1.1 | openSUSE-SU-2024:13225-1 |
| openSUSE Leap 15.5 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| openSUSE Leap 15.4 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| openSUSE Leap 15.4 | go1.18-openssl | 1.18.10.1-150000.1.9.1 | SUSE-SU-2023:2312-1 |
| openSUSE Leap 15.4 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
| openSUSE Leap 15.3 | go1.18 | 1.18.9-150000.1.40.1 | SUSE-SU-2022:4398-1 |
| openSUSE Leap 15.3 | go1.19 | 1.19.4-150000.1.18.1 | SUSE-SU-2022:4397-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.19.4-r0 | — |
| Alpine v3.24 | minio-client | 0.20230111.031416-r0 | — |
| Alpine v3.23 | go | 1.19.4-r0 | — |
| Alpine v3.23 | minio-client | 0.20230111.031416-r0 | — |
| Alpine v3.22 | go | 1.19.4-r0 | — |
| Alpine v3.22 | minio-client | 0.20230111.031416-r0 | — |
| Alpine v3.21 | go | 1.19.4-r0 | — |
| Alpine v3.21 | minio-client | 0.20230111.031416-r0 | — |
| Alpine v3.20 | go | 1.19.4-r0 | — |
| Alpine v3.20 | minio-client | 0.20230111.031416-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.19.4-r0 | — |
| Alpine v3.19 | minio-client | 0.20230111.031416-r0 | — |
| Alpine v3.18 | go | 1.19.4-r0 | — |
| Alpine v3.18 | minio-client | 0.20230111.031416-r0 | — |
| Alpine v3.17 | go | 1.19.4-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | golang +7 | 1.19.8-1.amzn2023.0.1 | ALAS2023-2023-175 |
| Amazon Linux 2 | golang +7 | 1.18.9-1.amzn2.0.1 | ALAS2-2023-1926 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | 1.17.13-2 | — |
| Azure Linux 3 | moby-engine | 25.0.3-1 | — |
| Azure Linux 3 | podman | 5.6.1-2 | — |
| Azure Linux 3 | prometheus | 2.45.4-1 | — |
| Azure Linux 3 | sriov-network-device-plugin | 3.7.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | azcopy | 10.24.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | containerized-data-importer | 1.55.0-20 | — |
| Azure Linux 2 (CBL-Mariner) | gh | 2.13.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | golang | 1.21.6-1 | — |
| Azure Linux 2 (CBL-Mariner) | moby-cli | 24.0.9-1 | — |
| Azure Linux 2 (CBL-Mariner) | nmi | 1.8.17-1 | — |
| Azure Linux 2 (CBL-Mariner) | podman | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | prometheus | 2.37.9-1 | — |
| Azure Linux 2 (CBL-Mariner) | sriov-network-device-plugin | 3.6.2-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | buildah +1 | 1:1.29.1-1.0.1.el9 | ELSA-2023-2253 |
| Oracle Linux 9 | cockpit-composer | 45-1.0.1.el9_2 | ELSA-2023-2204 |
| Oracle Linux 9 | conmon | 2:2.1.7-1.el9_2 | ELSA-2023-2222 |
| Oracle Linux 9 | containernetworking-plugins | 1:1.2.0-1.el9 | ELSA-2023-2367 |
| Oracle Linux 9 | git-lfs | 3.2.0-1.el9 | ELSA-2023-2357 |
| Oracle Linux 9 | grafana | 9.2.10-7.el9_3 | ELSA-2023-6420 |
| Oracle Linux 9 | osbuild +5 | 81-1.el9 | ELSA-2023-2204 |
| Oracle Linux 9 | osbuild-composer +3 | 76-2.el9_2 | ELSA-2023-2204 |
| Oracle Linux 9 | podman +5 | 2:4.4.1-3.0.1.el9 | ELSA-2023-2282 |
| Oracle Linux 9 | skopeo +1 | 2:1.11.2-0.1.el9 | ELSA-2023-2283 |
| Oracle Linux 9 | weldr-client | 35.9-1.el9 | ELSA-2023-2204 |
| Oracle Linux 8 | buildah +1 | 1:1.24.6-5.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | cockpit-composer | 45-1.0.1.el8_8 | ELSA-2023-2780 |
| Oracle Linux 8 | cockpit-podman | 46-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | conmon | 2:2.1.4-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | container-selinux | 2:2.199.0-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.1.1-2.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | containers-common | 2:1-37.0.1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | crit +4 | 3.15-3.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | crun | 1.6-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | delve | 1.9.1-1.0.1.module+el8.7.0+20922+47ac84ba | ELSA-2023-18908 |
| Oracle Linux 8 | fuse-overlayfs | 1.9-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | git-lfs | 3.2.0-2.el8 | ELSA-2023-2866 |
| Oracle Linux 8 | go-toolset | 1.19.4-1.module+el8.7.0+20922+47ac84ba | ELSA-2023-18908 |
| Oracle Linux 8 | golang +6 | 1.19.4-2.0.1.module+el8.7.0+20922+47ac84ba | ELSA-2023-18908 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | netavark +1 | 2:1.0.1-37.0.1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | osbuild +5 | 81-1.el8 | ELSA-2023-2780 |
| Oracle Linux 8 | osbuild-composer +3 | 75-1.el8 | ELSA-2023-2780 |
| Oracle Linux 8 | podman +6 | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | python3-podman | 4.0.0-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | runc | 1:1.1.4-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | skopeo +1 | 2:1.6.2-6.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | slirp4netns | 1.1.8-2.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | udica | 0.2.6-3.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | weldr-client | 35.9-2.el8 | ELSA-2023-2780 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow +12 | 1.10.0-r4 | — |
| Wolfi rolling | terraform-provider-sendgrid | 1.0.1-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
domdom82/h2conn-exploit ★ 0 · Dec 13, 2022
Exploit for CVE-2022-41717
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | golang.org/x/net | < 0.4.0 | 0.4.0 | GHSA-xrjj-mj9h-534m |
| Go | golang.org/x/net/http2 | < 0.4.0 | 0.4.0 | GHSA-xrjj-mj9h-534m |
| Go | stdlib | < 1.18.9 · >= 1.19.0-0, < 1.19.4 | 1.18.9, 1.19.4 | GO-2022-1144 |
Advisories 50
- ALSA-2023:6420 Moderate: grafana security and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2357 Moderate: git-lfs security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2367 Moderate: containernetworking-plugins security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2204 Moderate: Image Builder security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2236 Moderate: toolbox security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2253 Moderate: buildah security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2282 Moderate: podman security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2283 Moderate: skopeo security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2222 Moderate: conmon security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2802 Moderate: container-tools:4.0 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2866 Moderate: git-lfs security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2780 Moderate: Image Builder security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2758 Moderate: container-tools:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:6818 Red Hat Security Advisory: Satellite 6.14 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:5982 Red Hat Security Advisory: Red Hat Satellite Client security and bug fix update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:3612 Red Hat Security Advisory: OpenShift Container Platform 4.13.4 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:2802 Red Hat Security Advisory: container-tools:4.0 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:2758 Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:1325 Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:1275 Red Hat Security Advisory: Red Hat OpenStack Platform (etcd) security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:6420 Red Hat Security Advisory: grafana security and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:4470 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:3914 Red Hat Security Advisory: Red Hat OpenShift Enterprise security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:3910 Red Hat Security Advisory: Red Hat OpenShift Enterprise security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:3204 Red Hat Security Advisory: OpenShift Virtualization 4.13.0 RPMs security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2866 Red Hat Security Advisory: git-lfs security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2780 Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2367 Red Hat Security Advisory: containernetworking-plugins security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2283 Red Hat Security Advisory: skopeo security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2357 Red Hat Security Advisory: git-lfs security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2253 Red Hat Security Advisory: buildah security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2282 Red Hat Security Advisory: podman security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2236 Red Hat Security Advisory: toolbox security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2204 Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:2222 Red Hat Security Advisory: conmon security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:1329 Red Hat Security Advisory: OpenShift Container Platform 4.13.0 bug fix and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:1276 Red Hat Security Advisory: Red Hat OpenStack Platform (collectd-libpod-stats) security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:1268 Red Hat Security Advisory: OpenShift Container Platform 4.12.8 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:1179 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.27.1 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:0446 Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:0328 Red Hat Security Advisory: go-toolset and golang security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6038-2 golang-1.13, golang-1.16 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-6038-1 golang-1.18 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2024:12553-1 go1.19-1.19.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12615-1 traefik-2.9.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14076-1 traefik2-2.11.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4398-1 Security update for go1.18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2312-1 Security update for go1.18-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://go.dev/issue/56350
- https://go.dev/cl/455717
- https://go.dev/cl/455635
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
- https://pkg.go.dev/vuln/GO-2022-1144
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/
- https://security.gentoo.org/glsa/202311-09
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/