Skip to content
Fencer Intel
high 7.5

CVE-2022-41723 json

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

published 3y ago modified last mo. also BIT-golang-2022-41723 , EUVD-2023-0804 , GHSA-vvpx-j8f3-3w6h , GO-2023-1571

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.6%
EPSS 4.6% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Patch / fix

  • go golang.org/x/net 0.7.0
  • bitnami golang 1.19.6, 1.20.1
  • go stdlib 1.19.6, 1.20.1
  • Go standard library net/http 1.19.6, 1.20.1
  • golang.org/x/net golang.org/x/net/http2 0.7.0
  • golang.org/x/net golang.org/x/net/http2/hpack 0.7.0
  • golang-1.19 Debian 12 1.19.6-2
  • golang-golang-x-net Debian 14, Debian 13, Debian 12 1:0.7.0+dfsg-1

debian advisories DEBIAN-CVE-2022-41723

  • golang-1.17 Ubuntu 22.04 LTS 1.17.13-3ubuntu1.3
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.3
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.2
  • google-guest-agent Ubuntu 20.04 LTS 20231004.02-0ubuntu1~20.04.3
  • google-guest-agent Ubuntu 22.04 LTS 20231004.02-0ubuntu1~22.04.3
  • golang-golang-x-net Ubuntu 22.04 LTS 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
  • lxd Ubuntu Pro 16.04 LTS 2.0.11-0ubuntu1~16.04.4+esm2
  • lxd Ubuntu Pro 18.04 LTS 3.0.3-0ubuntu1~18.04.2+esm2

ubuntu advisories UBUNTU-CVE-2022-41723

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • criu RHEL 8 3.15-3.module+el8.9.0+19243+df4d9ff2
  • crun RHEL 8 1.8.3-1.module+el8.9.0+19098+6e7a5e3f
  • runc RHEL 8 1:1.1.5-2.module+el8.9.0+19104+fcef53a3
  • udica RHEL 8 0.2.6-4.module+el8.9.0+19098+6e7a5e3f
  • conmon RHEL 8 2:2.1.4-2.module+el8.9.0+19098+6e7a5e3f
  • podman RHEL 8 2:4.0.2-24.module+el8.9.0+19784+443be299
  • skopeo RHEL 8 2:1.6.2-8.module+el8.9.0+19104+fcef53a3

red hat advisories RHSA-2023:6938RHSA-2023:6939RHSA-2023:3083RHSA-2024:0948RHSA-2023:7058RHSA-2023:6473

  • terraform-provider-susepubliccloud SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 0.0.1-150100.3.14.1
  • terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
  • terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
  • terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1
  • terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.18.1
  • terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.17.1
  • terraform-provider-google SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.43.0-150200.6.12.1
  • terraform-provider-random SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.15.1

suse advisories SUSE-SU-2026:3057-1SUSE-SU-2026:3056-1SUSE-SU-2024:3656-1SUSE-SU-2024:3288-1SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1

  • go1.19 openSUSE Tumbleweed 1.19.6-1.1
  • go1.20 openSUSE Tumbleweed 1.20.1-1.1
  • grafana openSUSE Tumbleweed 9.3.6-2.1
  • go1.18 openSUSE Tumbleweed 1.18.10-1.1
  • docker-compose openSUSE Tumbleweed 2.17.0-1.1
  • kubescape openSUSE Tumbleweed 2.3.6-1.1
  • golang-github-lusitaniae-apache_exporter openSUSE Tumbleweed 1.0.0-1.1
  • golang-github-prometheus-prometheus openSUSE Tumbleweed 2.46.0-2.1

opensuse advisories openSUSE-SU-2024:12707-1openSUSE-SU-2024:12708-1openSUSE-SU-2024:12732-1openSUSE-SU-2024:12798-1openSUSE-SU-2024:12809-1openSUSE-SU-2024:13005-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
  • conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:6346ALSA-2023:6363ALSA-2023:6402ALSA-2023:6473

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • crun Rocky Linux 8 1.8.3-1.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • podman Rocky Linux 8 2:4.0.2-24.module+el8.9.0+1445+07728297
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:6938RLSA-2023:6939

  • go Alpine 3.17 1.19.6-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.20.1-r0
  • podman Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 4.4.3-r0

alpine advisories ALPINE-CVE-2022-41723

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.19.6-1
  • skopeo CBL-Mariner 2.0 1.12.0-3
  • telegraf CBL-Mariner 2.0 1.26.0-2
  • kubevirt CBL-Mariner 2.0 0.59.0-15
  • application-gateway-kubernetes-ingress Azure Linux 3.0 1.7.2-2
  • kubevirt Azure Linux 3.0 1.2.0-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-25350AZL-25939AZL-25940AZL-26732AZL-34543AZL-34908

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-41723 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-41723 updated cvss 7.5

golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

  • Red Hat Migration Toolkit for Applications 6 mta/mta-admin-addon-rhel8, mta/mta-windup-addon-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services odo, helm, ocp-tools-4/service-binding-rhel8-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: no fix available
  • Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-serving-controller-rhel9, openshift-serverless-1/kn-eventing-apiserver-receive-adapter-rhel9
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, openshift-service-mesh/prometheus-rhel8, openshift-service-mesh/istio-rhel8-operator Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-proxy, servicemesh-grafana, servicemesh-operator, servicemesh-ratelimit, +5 more
    affected: no fix planned “Will not fix”
  • Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator, 3scale-amp2/apicast-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel7 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat AMQ Broker 7 ansible-automation-platform-24/controller-rhel8-operator
    affected: no fix available
show 22 more
  • Red Hat Ansible Automation Platform 2 receptor, openshift-clients, rhc-catalog-worker
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Application Interconnect 1.0 skupper-cli Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
  • Red Hat Enterprise Linux 8 podman, skopeo, git-lfs, grafana, toolbox, grafana-loki, +28 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 butane, git-lfs, grafana, ignition, weldr-client, ignition-edge, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, ansible-service-broker, atomic-openshift-tests, atomic-openshift-master, +20 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 cri-o, skopeo, buildah, ignition, skopeo-tests, buildah-tests, +54 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 mcg, ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator, ocs4/volume-replication-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8, rhods/odh-operator-base-rhel8, rhods/odh-model-controller-rhel8, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-notebook-controller-rhel8, rhods/odh-modelmesh-runtime-adapter-rhel8, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8, devspaces/configbump-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-rhel8-operator, rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/dex-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/applicationset-rhel8, +1 more Red Hat OpenShift on AWS rosa
    affected: no fix available
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Virtualization 4 kubevirt, container-native-virtualization/kubemacpool, container-native-virtualization/bridge-marker, container-native-virtualization/ovs-cni-marker, container-native-virtualization/checkup-framework, container-native-virtualization/kubemacpool-rhel9, +18 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Software Collections rh-git227-git-lfs
    affected: no fix planned “Will not fix”
  • Red Hat Storage 3 heketi, heketi-client, python-heketi, rhgs3/rhgs-gluster-block-prov-rhel7
    affected: no fix planned “Out of support scope”
  • Red Hat Web Terminal web-terminal-exec-container, web-terminal/web-terminal-rhel9-operator Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/kubevirt-ssp-operator v4.12.5-7, container-native-virtualization/hostpath-provisioner-rhel8-operator v4.12.8-4
    fixed: vendor fix RHSA-2023:6248
  • Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/vm-console-proxy-rhel9 v4.13.3--2023-117063, container-native-virtualization/hostpath-provisioner-rhel9 v4.13.5--2023-120566, container-native-virtualization/kubevirt-ssp-operator-rhel9 v4.13.3--2023-117063, container-native-virtualization/hco-bundle-registry-rhel9 v4.13.4.rhel9--2023-118997, container-native-virtualization/hyperconverged-cluster-webhook-rhel9 v4.13.3--2023-117063
    fixed: vendor fix RHSA-2023:5233
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.3.0-5, cryostat-tech-preview/jfr-datasource-rhel8 2.3.0-5, cryostat-tech-preview/cryostat-reports-rhel8 2.3.0-5, cryostat-tech-preview/cryostat-rhel8-operator 2.3.0-5, cryostat-tech-preview/cryostat-operator-bundle 2.3.0-5, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.3.0-5
    fixed: vendor fix RHSA-2023:3167
  • Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.12.0-16, amq7/amq-broker-rhel8-operator-bundle 7.12.0-10
    fixed: vendor fix RHSA-2024:2944
  • Red Hat Migration Toolkit for Virtualization 2.4 migration-toolkit-virtualization/mtv-must-gather-api-rhel8 2.4.3-5
    fixed: vendor fix RHBA-2023:6109
  • Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-controller-rhel9 2.5.2-5
    fixed: vendor fix RHBA-2023:6078
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-hub-rhel9 6.2.0-16
    fixed: vendor fix RHSA-2023:4627
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.6-7, oadp/oadp-rhel8-operator 1.1.5-3, oadp/oadp-velero-plugin-rhel8 1.1.5-3, oadp/oadp-velero-plugin-rhel8 1.1.6-5, oadp/oadp-velero-plugin-for-aws-rhel8 1.1.6-5, oadp/oadp-velero-plugin-for-csi-rhel8 1.1.6-5, +4 more
    fixed: vendor fix RHSA-2023:5314

21 more fixed, 34 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 7.5

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

4.56% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/net
<0.7.0
0.7.0
bitnami golang
<1.19.6
>=1.20.0, <1.20.1
1.19.6
1.20.1
go stdlib
<1.19.6
>=1.20.0-0, <1.20.1
1.19.6
1.20.1

Affected products

  • Go standard library net/http
  • golang.org/x/net golang.org/x/net/http2
  • golang.org/x/net golang.org/x/net/http2/hpack

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.