VYPR
← All advisories
High severityNVD Advisory· Published Feb 28, 2023· Updated May 5, 2025

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

CVE-2022-41723

Description

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A maliciously crafted HTTP/2 stream can cause excessive CPU consumption in Go's HPACK decoder, leading to denial of service from a small number of small requests.

Root

Cause CVE-2022-41723 is a denial of service vulnerability in the HPACK decoder used by Go's net/http package for HTTP/2 connections. The decoder does not properly bound CPU usage when processing a maliciously crafted HTTP/2 stream, allowing an attacker to cause excessive CPU consumption with minimal bandwidth [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a small number of carefully crafted HTTP/2 requests to a Go-based server that accepts HTTP/2 connections. No authentication is required, and the attack can be carried out from a remote network position, making it accessible to any client capable of establishing an HTTP/2 connection [1][3].

Impact

Successful exploitation results in denial of service due to high CPU usage, potentially rendering the server unresponsive to legitimate requests. This can be achieved with just a few small requests, making the vulnerability easy to exploit and difficult to mitigate without a patch [2].

Mitigation

The vulnerability is fixed in Go 1.20.1 and Go 1.19.6, released on February 14, 2023. Users are advised to update their Go installations to these versions or later [2][3]. There are no known workarounds for this issue.

References
  1. NVD - CVE-2022-41723
  2. [security] Go 1.20.1 and Go 1.19.6 are released
  3. GO-2023-1571 - Go Packages

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/netGo
< 0.7.00.7.0

Affected products

327

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

25

News mentions

0

No linked articles in our index yet.