net-http up to 1.18.5/1.19.0 on Go HTTP/2 Connection denial of service

Summaryinfo

A vulnerability was found in net-http up to 1.18.5/1.19.0 on Go and classified as problematic. The affected element is an unknown function of the component HTTP2 Connection Handler. Such manipulation leads to denial of service. This vulnerability is documented as CVE-2022-27664. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in net-http up to 1.18.5/1.19.0 on Go. It has been rated as problematic. Affected by this issue is an unknown code of the component HTTP2 Connection Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

The weakness was released 09/07/2022. The advisory is shared for download at groups.google.com. This vulnerability is handled as CVE-2022-27664 since 03/23/2022. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 233307 (openSUSE 15 Security Update : cadvisor (openSUSE-SU-2025:0103-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.18.6 or 1.19.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (233307) and CERT Bund (WID-SEC-2023-1185). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• SUSE openSUSE
• Red Hat OpenShift
• RESF Rocky Linux

Productinfo

Name

• net-http

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.18.4
• 1.18.5
• 1.19.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion