~ / search / GHSA-fxg5-wq6x-vr4w

GHSA-fxg5-wq6x-vr4w

golang.org/x/net/http2/h2c vulnerable to request smuggling attack

Source: GitHub Advisory Database (reviewed) High CVE-2022-41721

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/net >= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862 0.1.1-0.20221104162952-702349b0e862

Details

As written in the advisory (Markdown source, shown as plain text).

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. ### Specific Go Packages Affected golang.org/x/net/http2/h2c

References

External links from the advisory. They lead to third-party sites.