Skip to content
Fencer Intel
high 7.5

CVE-2022-27664 json

golang.org/x/net/http2 Denial of Service vulnerability

published 4y ago modified last mo. also BIT-golang-2022-27664 , EUVD-2022-6718 , GHSA-69cg-p879-7622 , GO-2022-0969

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.5%
EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Patch / fix

  • go golang.org/x/net 0.0.0-20220906165146-f3363e06e74c
  • go golang.org/x/net/http2 0.0.0-20220906165146-f3363e06e74c
  • bitnami golang 1.18.6, 1.19.1
  • go stdlib 1.18.6, 1.19.1
  • golang go 1.18.6
  • golang-1.19 Debian 12 1.19.1-1
  • golang-golang-x-net Debian 14, Debian 13, Debian 12 1:0.0+git20221012.0b7e1fb+dfsg-1

debian advisories DEBIAN-CVE-2022-27664

  • golang-1.13 Ubuntu 20.04 LTS 1.13.8-1ubuntu1.2
  • golang-1.13 Ubuntu 22.04 LTS 1.13.8-1ubuntu2.22.04.2
  • golang-1.16 Ubuntu 20.04 LTS 1.16.2-0ubuntu1~20.04.1
  • golang-1.18 Ubuntu 18.04 LTS 1.18.1-1ubuntu1~18.04.4
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.2
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.1
  • google-guest-agent Ubuntu 20.04 LTS 20231004.02-0ubuntu1~20.04.3
  • google-guest-agent Ubuntu 22.04 LTS 20231004.02-0ubuntu1~22.04.3

ubuntu advisories UBUNTU-CVE-2022-27664

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.9.0+20656+56f336b9
  • criu RHEL 8 3.15-3.module+el8.9.0+20656+56f336b9
  • crun RHEL 8 1.8.7-1.module+el8.9.0+20656+56f336b9
  • runc RHEL 8 1:1.1.5-2.module+el8.9.0+20656+56f336b9
  • udica RHEL 8 0.2.6-4.module+el8.9.0+20656+56f336b9
  • conmon RHEL 8 2:2.1.4-2.module+el8.9.0+20656+56f336b9
  • podman RHEL 8 2:4.0.2-25.module+el8.9.0+20875+8dd9d5d2
  • skopeo RHEL 8 2:1.6.2-9.module+el8.9.0+20656+56f336b9

red hat advisories RHSA-2024:0121RHSA-2023:2802RHSA-2023:2758RHSA-2023:0446RHSA-2023:5009RHSA-2023:4734

  • rhnlib Manager Client Tools 15-BETA 5.0.1-159000.6.30.1
  • ansible Manager Client Tools 15-BETA 2.9.27-159000.3.9.1
  • grafana Manager Client Tools 15-BETA 9.5.8-159000.4.24.1
  • mgr-push Manager Client Tools 15-BETA 5.0.1-159000.4.21.1
  • spacecmd Manager Client Tools 15-BETA 5.0.1-159000.6.42.1
  • python-hwdata Manager Client Tools 15-BETA 2.3.5-159000.5.13.1
  • python-pyvmomi Manager Client Tools 15-BETA 6.7.3-159000.3.6.1
  • dracut-saltboot Manager Client Tools Beta for SLE Micro 5, Manager Client Tools 15-BETA 0.1.1681904360.84ef141-159000.3.30.1

suse advisories SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-SU-2023:2579-1SUSE-SU-2023:2578-1SUSE-SU-2023:2575-1SUSE-SU-2023:2312-1

  • cadvisor Package Hub 15 SP6, openSUSE Leap 15.6 0.52.1-bp156.3.3.1
  • cadvisor openSUSE Tumbleweed 0.49.1-1.1
  • go1.18 openSUSE Tumbleweed 1.18.6-1.1
  • go1.19 openSUSE Tumbleweed 1.19.1-1.1
  • docker-compose openSUSE Tumbleweed 2.15.1-1.1
  • grafana openSUSE Tumbleweed 9.3.6-1.1
  • kubernetes1.25 openSUSE Tumbleweed 1.25.7-1.1

opensuse advisories openSUSE-SU-2025:0103-1openSUSE-SU-2024:14121-1openSUSE-SU-2024:12309-1openSUSE-SU-2024:12310-1openSUSE-SU-2024:12600-1openSUSE-SU-2024:12723-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.7-1.module_el8.9.0+3683+33eb0feb
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3687+dcd7ef8f
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2024:0121ALSA-2023:2758ALSA-2023:2780ALSA-2023:2784ALSA-2023:2785ALSA-2023:2802

  • grafana-pcp Rocky Linux 9 5.1.1-14.el9_7
  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • cockpit-podman Rocky Linux 8 46-1.module+el8.9.0+1445+07728297
  • oci-seccomp-bpf-hook Rocky Linux 8 1.2.5-2.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:2177RLSA-2023:2758RLSA-2023:2802RLSA-2024:0121RLSA-2022:7129

  • go Alpine 3.16 1.18.6-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.19.1-r0
  • docker-cli-compose Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.15.1-r0

alpine advisories ALPINE-CVE-2022-27664

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.18.8-1
  • kured CBL-Mariner 2.0 1.13.2-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-10855AZL-31963AZL-37328AZL-52863

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-27664 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-27664 updated cvss 6.5

golang: net/http: handle server errors after sending GOAWAY

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift Developer Tools and Services odo, helm
    affected: no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: no fix planned “Will not fix”
  • Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 receptor, openshift-clients
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Application Interconnect 1.0 skupper-cli
    affected: no fix available
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
  • Red Hat Enterprise Linux 8 podman, skopeo, buildah, toolbox, podman-tests, skopeo-tests, +10 more Red Hat Enterprise Linux 9 podman, skopeo, buildah, ignition, podman-tests, skopeo-tests, +10 more
    affected: no fix planned “Will not fix”
show 19 more
  • Red Hat OpenShift Container Platform 4 butane, conmon, ignition, openshift, ignition-validate, openshift-clients, +8 more Red Hat Openshift Data Foundation 4 mcg Red Hat OpenShift Dev Spaces devspaces/devspaces-rhel8-operator Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8
    affected: no fix available
  • Red Hat OpenShift on AWS rosa
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: no fix available
  • Red Hat OpenStack Platform 16.2 collectd-libpod-stats, rhosp-rhel8-tech-preview/osp-director-operator
    affected: no fix planned “Will not fix”
  • Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more
    affected: no fix planned “Out of support scope”
  • Red Hat Web Terminal web-terminal-exec-container
    affected: no fix available “Fix deferred”
  • Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
  • Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat CNV 4.13 for RHEL 7 kubevirt 4.13.0-1469.el7, kubevirt-virtctl 4.13.0-1469.el7, kubevirt-virtctl-redistributable 4.13.0-1469.el7 Red Hat CNV 4.13 for RHEL 8 kubevirt 4.13.0-1469.el8, kubevirt-virtctl 4.13.0-1469.el8, kubevirt-virtctl-redistributable 4.13.0-1469.el8 Red Hat CNV 4.13 for RHEL 9 kubevirt 4.13.0-1469.el9, kubevirt-virtctl 4.13.0-1469.el9, kubevirt-virtctl-redistributable 4.13.0-1469.el9, container-native-virtualization/virt-api-rhel9 v4.13.0--2022-101182
    fixed: vendor fix RHSA-2023:3204
  • Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10
    fixed: vendor fix RHSA-2024:2944
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.1-20
    fixed: vendor fix RHSA-2022:8634
  • Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8 2.8.2-143
    fixed: vendor fix RHSA-2023:1042
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-26
    fixed: vendor fix RHSA-2023:0584
  • Red Hat Quay v3 quay/clair-rhel8 v3.8.11-3, quay/quay-rhel8 v3.8.11-13, quay/quay-builder-rhel8 v3.8.11-4, quay/quay-operator-rhel8 v3.8.11-3, quay/quay-operator-bundle v3.8.11-20, quay/quay-bridge-operator-rhel8 v3.8.11-3, +4 more
    fixed: vendor fix RHBA-2023:4275
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix RHSA-2023:3642
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.15-4.el8, git-lfs 2.13.3-3.el8_6, grafana-pcp 3.2.0-3.el8, weldr-client 35.9-2.el8, osbuild-composer 75-1.el8, osbuild-composer-core 75-1.el8, +109 more
    fixed: vendor fix RHSA-2022:7129
  • Red Hat Enterprise Linux AppStream (v. 9) butane 0.16.0-1.el9, git-lfs 3.2.0-1.el9, grafana 9.0.9-2.el9, golang 1.18.9-1.el9_1, toolbox 0.0.99.3-9.el9, grafana-pcp 5.1.1-1.el9, +11 more
    fixed: vendor fix RHSA-2023:0328
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.7-3, rhmtc/openshift-migration-openvpn-rhel8 v1.7.7-2
    fixed: vendor fix RHSA-2023:0693
  • Red Hat OpenShift Container Platform 4.11 cri-tools 1.24.2-7.el8, cri-o 1.24.4-5.rhaos4.11.git57d7127.el8, openshift4/ose-cli v4.11.0-202211072116.p0.g142cb44.assembly.stream, openshift4/ose-pod v4.11.0-202211072116.p0.g5157800.assembly.stream, openshift4/ose-tests v4.11.0-202211072116.p0.gaa67fda.assembly.stream, openshift4/ose-console v4.11.0-202211072116.p0.gb452647.assembly.stream, +165 more
    fixed: vendor fix RHBA-2023:0564

12 more fixed, 24 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.49% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/net
<0.0.0-20220906165146-f3363e06e74c
0.0.0-20220906165146-f3363e06e74c
go golang.org/x/net/http2
<0.0.0-20220906165146-f3363e06e74c
0.0.0-20220906165146-f3363e06e74c
bitnami golang
<1.18.6
>=1.19.0, <1.19.1
1.18.6
1.19.1
go stdlib
<1.18.6
>=1.19.0-0, <1.19.1
1.18.6
1.19.1

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.