CVE-2022-41721 - CVE House
Back to Database
Status published Unknown CVE-2022-41721

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

Vulnerability Description

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-41721

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • John Howard (Google)

References

More from golang.org/x/net

View All →
CVE-2025-58190
Infinite parsing loop in golang.org/x/net
Unknown 0
CVE-2025-47911
Quadratic parsing complexity in golang.org/x/net/html
Unknown 0
CVE-2025-22872
Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
Unknown 0
CVE-2024-45338
Non-linear parsing of case-insensitive content in golang.org/x/net/html
Unknown 0
CVE-2023-3978
Improper rendering of text nodes in golang.org/x/net/html
Unknown 0

Affected Vendor

golang.org/x/net

View all reports →

Affected Software

golang.org/x/net/http2/h2c
Vulnerable Versions:
0.0.0-20220524220425-1d687d428aca

Timeline

Official Publish: January 13th, 2023
Last Modified: April 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.