Security Advisories

CVE-2022-41721

Published

Last updated

https://nvd.nist.gov/vuln/detail/CVE-2022-41721

Severity

7.5

High

CVSS V3

Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

References

https://github.com/advisories/GHSA-fxg5-wq6x-vr4w
https://go.dev/cl/447396
https://go.dev/issue/56352
https://pkg.go.dev/vuln/GO-2023-1495
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/
https://security-tracker.debian.org/tracker/CVE-2022-41721

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2022-41721

Severity

Description

References

Affected packages

Product

Why Chainguard

Customers

Company

Resources