CVE-2022-41721 Vulnerability Details

  /     /     /  

CVE-2022-41721 Metadata Quick Info

CVE Published: 13/01/2023 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: Go | Vendor: golang.org/x/net | Product: golang.org/x/net/http2/h2c
Status : PUBLISHED

---

CVE-2022-41721 Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE 444: Inconsistent Interpretation of HTTP Requests ("HTTP Request/Response Smuggling)
Source: golang.org/x/net

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).