CVE-2021-44716

Go/golang.org/x/net/http2 CVE-2021-44716: high 7.5, EPSS 3.96%

golang.org/x/net/http2 allows uncontrolled memory consumption

Action: Upgrade golang.org/x/net/http2 to 0.0.0-20211209124913-491a49abca63 or later.

go get golang.org/x/net/http2@v0.0.0-20211209124913-491a49abca63

Affected

Fixed versions

Sources

• osv: GHSA-vc3p-29h2-gpcp
• https://nvd.nist.gov/vuln/detail/CVE-2021-44716
• https://go.dev/cl/369794
• https://go.dev/issue/50058
• https://groups.google.com/g/golang-announce/c/hcmEScgc00k
• https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
• https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html
• https://pkg.go.dev/vuln/GO-2022-0288
• https://security.gentoo.org/glsa/202208-02
• https://security.netapp.com/advisory/ntap-20220121-0002

CVE-2021-44716 · published 2022-01-02T00:00:48Z · modified 2023-12-06T01:01:41.998827Z · JSON

Go/stdlib CVE-2021-44716: unknown, EPSS 3.96%

Unbounded memory growth in net/http and golang.org/x/net/http2

Action: Upgrade stdlib to 1.16.12 or later.

Upgrade Go to 1.16.12.

Upgrade Go to 1.17.5.

Affected

Fixed versions

Sources

• osv: GO-2022-0288
• https://go.dev/cl/369794
• https://go.dev/issue/50058
• https://groups.google.com/g/golang-announce/c/hcmEScgc00k

CVE-2021-44716 · published 2022-07-15T23:08:33Z · modified 2024-05-20T16:03:47Z · JSON

Go/golang.org/x/net CVE-2021-44716: unknown, EPSS 3.96%

Unbounded memory growth in net/http and golang.org/x/net/http2

Action: Upgrade golang.org/x/net to 0.0.0-20211209124913-491a49abca63 or later.

go get golang.org/x/net@v0.0.0-20211209124913-491a49abca63

Affected

Fixed versions

Sources

• osv: GO-2022-0288#Go/golang.org/x/net
• https://go.dev/cl/369794
• https://go.dev/issue/50058
• https://groups.google.com/g/golang-announce/c/hcmEScgc00k

CVE-2021-44716 · published 2022-07-15T23:08:33Z · modified 2024-05-20T16:03:47Z · JSON