{"id":"CVE-2021-44716","published":"2022-01-01T00:00:00Z","modified":"2024-08-04T04:32:12Z","title":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header…","vendor":null,"product":null,"tier":"tail","description":{"text":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04254,"percentile":0.9102,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20220121-0002/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","tags":["mailing-list"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","tags":["mailing-list"]}],"priority":{"score":18.2,"factors":[{"name":"EPSS percentile","points":18.2}]},"affected":[{"ecosystem":"Go","package":"golang.org/x/net/http2","vulnerableRanges":["<0.0.0-20211209124913-491a49abca63"],"patched":["0.0.0-20211209124913-491a49abca63"],"from":["GHSA-vc3p-29h2-gpcp"],"provenance":"source"},{"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.16.12",">=1.17.0-0, <1.17.5"],"patched":["1.16.12","1.17.5"],"from":["GO-2022-0288"],"provenance":"source"},{"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.0.0-20211209124913-491a49abca63"],"patched":["0.0.0-20211209124913-491a49abca63"],"from":["GO-2022-0288"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0700","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-openstack-platform-16-1-cve-2021-44716","children":[{"from":"CVE-2021-44716","to":"CVE-2024-4437","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716.","from":"CVE.org","in":"CVE-2024-4437"}]}],"packageHistory":[{"cve":"CVE-2019-9514","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false},{"cve":"CVE-2021-31525","published":"2021-05-27","fixed":"0.0.0-20210428140749-89ef3d95e781","kev":false},{"cve":"CVE-2021-33194","published":"2021-05-26","fixed":"0.0.0-20210520170846-37e1c6afe023","kev":false,"link":{"from":"CVE-2021-33194","to":"CVE-2021-44716","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20210520170846-37e1c6afe023","toFixed":"0.0.0-20211209124913-491a49abca63","daysApart":220}]}},{"cve":"CVE-2021-44716","published":"2022-01-01","fixed":"0.0.0-20211209124913-491a49abca63","kev":false},{"cve":"CVE-2022-27664","published":"2022-09-06","fixed":"0.0.0-20220906165146-f3363e06e74c","kev":false,"link":{"from":"CVE-2021-44716","to":"CVE-2022-27664","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20211209124913-491a49abca63","toFixed":"0.0.0-20220906165146-f3363e06e74c","daysApart":248},{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net/http2","fromFixed":"0.0.0-20211209124913-491a49abca63","toFixed":"0.0.0-20220906165146-f3363e06e74c","daysApart":248}]}},{"cve":"CVE-2022-41721","published":"2023-01-13","fixed":"0.1.1-0.20221104162952-702349b0e862","kev":false},{"cve":"CVE-2022-41717","published":"2022-12-08","fixed":"0.4.0","kev":false}],"package":"Go:golang.org/x/net"}}