VYPR
← All advisories
High severityNVD Advisory· Published Sep 6, 2022· Updated Aug 3, 2024

CVE-2022-27664

CVE-2022-27664

Description

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In Go's net/http package, an HTTP/2 connection can hang indefinitely during shutdown if preempted by a fatal error, enabling denial of service.

Vulnerability

Details CVE-2022-27664 is a denial-of-service vulnerability in Go's net/http package affecting HTTP/2 connections. The root cause is that when an HTTP/2 server initiates a graceful shutdown by sending a GOAWAY frame, if a fatal error occurs during that process, the connection can hang indefinitely waiting for a clean shutdown that never completes [2][4]. This is due to improper handling of errors during the shutdown sequence.

Exploitation

An attacker can exploit this by causing a fatal error on the server while it is closing an HTTP/2 connection. No authentication is required if the attacker can send requests to the server. The hang prevents the connection from being reused, leading to resource exhaustion and denial of service [4].

Impact

Successful exploitation results in a denial of service. The server may become unresponsive as connections hang, consuming resources. There is no risk of code execution or data breach [2][3].

Mitigation

The vulnerability is fixed in Go 1.18.6 and 1.19.1. Users should update to these versions or later. No workaround is available [4].

References
  1. NVD - CVE-2022-27664
  2. GO-2022-0969 - Go Packages
  3. [security] Go 1.19.1 and Go 1.18.6 are released

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/netGo
< 0.0.0-20220906165146-f3363e06e74c0.0.0-20220906165146-f3363e06e74c
golang.org/x/net/http2Go
< 0.0.0-20220906165146-f3363e06e74c0.0.0-20220906165146-f3363e06e74c

Affected products

247

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

15

News mentions

0

No linked articles in our index yet.