VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 8, 2022· Updated Feb 13, 2025

Excessive memory growth in net/http and golang.org/x/net/http2

CVE-2022-41717

Description

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2022-41717: an HTTP/2 header key cache in Go's net/http allows an attacker to cause ~64 MiB memory growth per connection.

Vulnerability

Details

CVE-2022-41717 is a memory exhaustion vulnerability in Go's net/http package affecting servers that accept HTTP/2 requests. The root cause lies in the HTTP/2 header key cache: while the number of cache entries is bounded, an attacker can send very large HTTP header keys, causing the server to allocate approximately 64 MiB of memory per open connection [1] [2].

Exploitation

The attack requires no authentication or special permissions—any client that can establish an HTTP/2 connection to a vulnerable Go server can trigger the memory allocation. The attacker simply sends HTTP/2 frames containing oversized header keys; the server caches each key, and the per‑connection memory consumption grows linearly with the size of the keys [2].

Impact

By opening multiple connections, an attacker can exhaust the server’s available memory, leading to a denial of service (DoS) condition. The memory is not released until the connection is closed, so sustained or repeated connections can cause the server to become unresponsive or crash [1].

Mitigation

Go released fixes in versions 1.19.4 and 1.18.9 on December 6, 2022, which limit the header key cache by total bytes instead of by entry count [2]. Users manually configuring HTTP/2 should apply the fix to golang.org/x/net/http2. Fedora also released updated packages [3] [4]. No workaround is available for unpatched versions.

References
  1. NVD - CVE-2022-41717
  2. [security] Go 1.19.4 and Go 1.18.9 are released
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/net/http2Go
< 0.4.00.4.0
golang.org/x/netGo
< 0.4.00.4.0

Affected products

109

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

43

News mentions

0

No linked articles in our index yet.