7.5
High
CVE-2022-41723 A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a…
Description
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| net/http 1.20 | 1.20.0-0 → < 1.20.1 | 1.20.1 |
| net/http 1.19 | earliest → < 1.19.6 | 1.19.6 |
| golang.org/x/net/http2 0.7 | earliest → < 0.7.0 | 0.7.0 |
| golang.org/x/net/http2/hpack 0.7 | earliest → < 0.7.0 | 0.7.0 |
Other CVEs of net/http
The 26 CVEs of net/http →
CVE-2026-97032
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
7.5
High
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream…
9.1
Critical
CVE-2026-78669
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams…
7.5
High
CVE-2026-78667
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)…
7.5
High