Skip to content
OpenAdvisories
High · 7.5 CVE-2022-41721 EUVD-2023-0462GHSA-fxg5-wq6x-vr4wGO-2023-1495

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

Published Jan 13, 2023 · Updated Apr 4, 2025 · Assigned by Go

Vendor: golang.org/x/net Product: golang.org/x/net/http2/h2c Package: golang-golang-x-net Package: golang.org/x/net Package: opa Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go

Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Affected products

VendorProductAffectedFixed
golang.org/x/net golang.org/x/net/http2/h2c 0.0.0-20220524220425-1d687d428aca – < 0.1.1-0.20221104162952-702349b0e862 0.1.1-0.20221104162952-702349b0e862

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-golang-x-net 1:0.4.0+dfsg-1 —
Debian 13 golang-golang-x-net 1:0.4.0+dfsg-1 —
Debian 12 golang-golang-x-net 1:0.4.0+dfsg-1 —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed caddy 2.6.3-1.1 openSUSE-SU-2024:12666-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) opa 0.50.2-5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/net >= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862 0.1.1-0.20221104162952-702349b0e862 GHSA-fxg5-wq6x-vr4w

Advisories 2

References