CVE-2022-41717

Name	CVE-2022-41717
Description	An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-1.11 (PTS)	buster	1.11.6-1+deb10u4	vulnerable
	buster (security)	1.11.6-1+deb10u7	vulnerable
golang-1.15 (PTS)	bullseye	1.15.15-1~deb11u4	vulnerable
golang-1.19 (PTS)	bookworm	1.19.8-2	fixed
golang-golang-x-net (PTS)	bullseye	1:0.0+git20210119.5f4716e+dfsg-4	vulnerable
	bookworm	1:0.7.0+dfsg-1	fixed
	sid, trixie	1:0.23.0+dfsg-1	fixed
golang-golang-x-net-dev (PTS)	buster	1:0.0+git20181201.351d144+dfsg-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
golang-1.11	source	(unstable)	(unfixed)
golang-1.15	source	(unstable)	(unfixed)
golang-1.18	source	(unstable)	1.18.9-1
golang-1.19	source	(unstable)	1.19.4-1
golang-golang-x-net	source	(unstable)	1:0.4.0+dfsg-1
golang-golang-x-net-dev	source	(unstable)	(unfixed)

Notes

[bullseye] - golang-1.15 <no-dsa> (Minor issue)
[buster] - golang-1.11 <postponed> (Limited support, follow bullseye DSAs/point-releases)
[bullseye] - golang-golang-x-net <no-dsa> (Minor issue)
[buster] - golang-golang-x-net-dev <postponed> (Limited support, follow bullseye DSAs/point-releases)
https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU
https://go.dev/issue/56350
https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27 (go1.19.4)
https://github.com/golang/go/commit/76cad4edc29d28432a7a0aa27e87385d3d7db7a1 (go1.18.9)
https://github.com/golang/net/commit/1e63c2f08a10a150fa02c50ece89b340ae64efe4 (v0.4.0)