PT-2023-14021 · Google +1 · Golang.Org/X/Net/Http2/H2C +1

🗓️ 13 Jan 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Request smuggling in golang.org/x/net/http2/h2c via MaxBytesHandler allows misreading the body.

Reporter	Title	Published	Views	Family All 80
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties affects IBM Watson Machine Learning Accelerator 3.5.0 for Cloud Pak for Data 4.6.5	8 Feb 202419:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple ansible-operator and opm vulnerabilities	20 Feb 202419:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	28 Feb 202421:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Go affects watsonx.data	5 Sep 202418:50	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2022-41721 may affect IBM CICS TX Standard	4 Apr 202313:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Pypa Setuptools, Golang Go, OpenSSH, Minio and Certifi may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	26 Mar 202503:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTTP request smuggling in Golang Go ( CVE-2022-41721)	28 Jun 202320:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion and IBM Storage Fusion HCI may be vulnerable to denial of service and link following via Go-Yaml, kube-apiserver, Golang Go and Beego	29 Aug 202321:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Data Management Console (CVE-2022-23648, CVE-2022-32149)	3 Jul 202509:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	26 Apr 202319:38	–	ibm

Source	Link
go	www.go.dev/issue/56352
osv	www.osv.dev/vulnerability/GO-2023-1495
osv	www.osv.dev/vulnerability/GHSA-fxg5-wq6x-vr4w
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN
osv	www.osv.dev/vulnerability/CVE-2022-41721
go	www.go.dev/cl/447396
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-41721
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-41721
pkg	www.pkg.go.dev/vuln/GO-2023-1495
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP

04 Apr 2025 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.00074

SSVC

request smuggling http two frames maxbytes golang net