CVE-2021-44716 golang.org/x/net/http2 allows uncontrolled memory consumption
Attackers can cause uncontrolled memory consumption in Go's HTTP/2 header cache, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44716?
CVE-2021-44716 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 1 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Weakness: CWE-400
Which versions are affected by CVE-2021-44716?
5 open source packages ship an affected version, including golang.org/x/net/http2, golang and golang.org/x/net. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net/http2 Go | All versions | 0.0.0-20211209124913-491a49abca63 |
golang.org/x/net/http2 Go | All versions | 0.0.0-20211209124913-491a49abca63 |
golang Bitnami | All versions | 1.16.12, 1.17.5 |
golang.org/x/net Go | All versions | 0.0.0-20211209124913-491a49abca63 |
stdlib Go | All versions | 1.16.12, 1.17.5 |
Linux distribution packages (9)
grafana AlmaLinux:8 | All versions | 7.5.9-5.el8_5 |
grafana Red Hat:enterprise_linux:8::appstream | All versions | 0:7.5.9-5.el8_5 |
grafana-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:7.5.9-5.el8_5 |
grafana Red Hat:rhel_eus:8.4::appstream | All versions | 0:7.3.6-4.el8_4 |
grafana-debuginfo Red Hat:rhel_eus:8.4::appstream | All versions | 0:7.3.6-4.el8_4 |
etcd Red Hat:storage:3.5:wa:el7 | All versions | 0:3.3.23-9.el7rhgs |
etcd-debuginfo Red Hat:storage:3.5:wa:el7 | All versions | 0:3.3.23-9.el7rhgs |
grafana Red Hat:storage:3.5:wa:el7 | All versions | 0:5.2.4-5.el7rhgs |
grafana Rocky Linux:8 | All versions | 0:7.5.9-5.el8_5 |
Products include Debian Debian Linux, Golang Go, Netapp Cloud Insights Telegraf.
How do I fix CVE-2021-44716?
Upgrade golang.org/x/net/http2 to 0.0.0-20211209124913-491a49abca63 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-44716 being exploited?
There is no known exploitation of CVE-2021-44716 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2022:0001, AZL-31978, AZL-33564, AZL-33571, AZL-33577, AZL-33581 and 33 more.