CVE-2022-41721 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
Attackers can perform request smuggling in Go HTTP2 servers using MaxBytesHandler, potentially leading to code execution or security bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41721?
CVE-2022-41721 is a high-severity vulnerability in golang.org/x/net/http2/h2c, published on 13 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Weakness: CWE-444
Which versions are affected by CVE-2022-41721?
3 open source packages ship an affected version, including golang.org/x/net. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net Go | From 0.0.0-20220524220425-1d687d428aca | 0.1.1-0.20221104162952-702349b0e862 |
golang.org/x/net Go | From 0.0.0-20220524220425-1d687d428aca | 0.1.1-0.20221104162952-702349b0e862 |
golang.org/x/net Go | From 0.0.0-20220524220425-1d687d428aca | 0.1.1-0.20221104162952-702349b0e862 |
Linux distribution packages (1)
caddy openSUSE:Tumbleweed | All versions | 2.6.3-1.1 |
Products include Golang H2c.
How do I fix CVE-2022-41721?
Upgrade golang.org/x/net to 0.1.1-0.20221104162952-702349b0e862 or later.
Is CVE-2022-41721 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41721 exists.
Sources
Also known as AZL-13029, CLEANSTART-2026-PT09141, CLEANSTART-2026-ZK86640, DEBIAN-CVE-2022-41721, GHSA-fxg5-wq6x-vr4w, GO-2023-1495 and 1 more.