CVE-2021-44716 json
golang.org/x/net/http2 allows uncontrolled memory consumption
published 2022-01-01 4 y ago modified 2026-10-16 24 d ago also BIT-golang-2021-44716 , EUVD-2022-0700 , GHSA-vc3p-29h2-gpcp , GO-2022-0288
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.3%
- EPSS 4.3% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Patch / fix
- go golang.org/x/net/http2 0.0.0-20211209124913-491a49abca63
- bitnami golang 1.16.12, 1.17.5
- go stdlib 1.16.12, 1.17.5
- go golang.org/x/net 0.0.0-20211209124913-491a49abca63
- golang go 1.16.12, 1.17.5
- golang-golang-x-net Debian 14, Debian 13, Debian 12 1:0.0+git20211209.491a49a+dfsg-1
debian advisories DEBIAN-CVE-2021-44716
- google-guest-agent Ubuntu 20.04 LTS 20231004.02-0ubuntu1~20.04.3
- google-guest-agent Ubuntu 22.04 LTS 20231004.02-0ubuntu1~22.04.3
ubuntu advisories UBUNTU-CVE-2021-44716
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- delve RHEL 8 1.6.0-1.module+el8.5.0+10379+d6b83bd0
- golang RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
- go-toolset RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
- golang-bin RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
- golang-src RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
- golang-misc RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
- golang-race RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
- golang-tests RHEL 8 1.16.12-1.module+el8.5.0+13637+960c7771
red hat advisories RHSA-2021:5160RHSA-2023:0407RHSA-2022:1361RHSA-2022:1628RHSA-2022:1056RHSA-2022:0927
- rubygem-puma OpenStack Cloud Crowbar 8 2.16.0-3.18.1
- grafana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 6.7.4-4.23.1
- python-Django OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.11.29-3.42.1
- ardana-ansible OpenStack Cloud 8, HPE Helion OpenStack 8 8.0+git.1660773729.3789a6d-3.85.1
- ardana-cobbler OpenStack Cloud 8, HPE Helion OpenStack 8 8.0+git.1660773402.d845a45-3.47.1
- rabbitmq-server OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 3.6.16-3.13.1
- openstack-murano OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.0.2~dev3-3.12.1
- venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.45.1
suse advisories SUSE-SU-2022:3338-1SUSE-SU-2022:1729-1SUSE-SU-2021:4186-1SUSE-SU-2021:4169-1
- go1.16 openSUSE Tumbleweed 1.16.12-1.1
- go1.17 openSUSE Tumbleweed 1.17.5-1.1
- apptainer openSUSE Leap 15.4 1.1.2-lp154.2.1
- go1.16 openSUSE Leap 15.2 1.16.12-lp152.20.1
- go1.17 openSUSE Leap 15.3 1.17.5-1.14.2
- go1.16 openSUSE Leap 15.3 1.16.12-1.37.2
opensuse advisories openSUSE-SU-2024:11671-1openSUSE-SU-2024:11672-1openSUSE-SU-2023:0018-1openSUSE-SU-2021:1626-1openSUSE-SU-2021:4186-1openSUSE-SU-2021:4169-1
- grafana AlmaLinux 8 7.5.9-5.el8_5
- delve AlmaLinux 8 1.6.0-1.module_el8.5.0+2604+960c7771
- golang AlmaLinux 8 1.16.12-1.module_el8.5.0+2604+960c7771
- go-toolset AlmaLinux 8 1.16.12-1.module_el8.5.0+2604+960c7771
- golang-bin AlmaLinux 8 1.16.12-1.module_el8.5.0+2604+960c7771
- golang-src AlmaLinux 8 1.16.12-1.module_el8.5.0+2604+960c7771
- golang-misc AlmaLinux 8 1.16.12-1.module_el8.5.0+2604+960c7771
- golang-race AlmaLinux 8 1.16.12-1.module_el8.5.0+2604+960c7771
almalinux advisories ALSA-2022:0001ALSA-2021:5160
- grafana Rocky Linux 8 7.5.9-5.el8_5
- delve Rocky Linux 8 1.6.0-1.module+el8.5.0+694+f77f0bfd
- golang Rocky Linux 8 1.16.12-1.module+el8.5.0+720+c057d5cf
- go-toolset Rocky Linux 8 1.16.12-1.module+el8.5.0+720+c057d5cf
rocky linux advisories RLSA-2022:0001RLSA-2021:5160
- go Alpine 3.14 1.16.15-r0
- go Alpine 3.15 1.17.9-r0
- go Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.17.6-r0
- nomad Alpine 3.15 1.1.12-r0
- nomad Alpine 3.18, Alpine 3.17, Alpine 3.16 1.2.6-r0
alpine advisories ALPINE-CVE-2021-44716
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kured CBL-Mariner 2.0 1.13.2-1
- application-gateway-kubernetes-ingress CBL-Mariner 2.0 1.4.0-19
- cf-cli CBL-Mariner 2.0 8.4.0-16
- csi-driver-lvm CBL-Mariner 2.0 0.4.1-15
- flannel CBL-Mariner 2.0 0.14.0-21
- git-lfs CBL-Mariner 2.0 3.1.4-17
- jx CBL-Mariner 2.0 3.2.236-16
- keda CBL-Mariner 2.0 2.4.0-19
azure linux advisories AZL-31978AZL-33564AZL-33571AZL-33577AZL-33581AZL-33585
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- go Arch Linux 2:1.17.5-1
arch linux advisories AVG-2617
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-44716 updated cvss 7.5
golang: net/http: limit growth of header canonicalization cache
-
Red Hat Migration Toolkit for Containers cpmaaffected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-serving-controller-rhel9 Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheusaffected: workaround, no fix available
-
Red Hat Ceph Storage 3 grafana, grafana-container, prometheus-node-exporter Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 4 prometheus-promu, openshift-prometheus-promu, golang-github-prometheus-promu, openshift-golang-builder-containeraffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Openshift Data Foundation 4 noobaa-operator-container Red Hat OpenShift distributed tracing 2 rhosdt/opentelemetry-rhel8-operatoraffected: workaround, no fix available
-
Red Hat OpenShift Virtualization 2 kubevirt, virt-api-container, kubemacpool-container, virt-handler-container, bridge-marker-container, virt-launcher-container, +22 more Red Hat OpenShift Virtualization 4 cnv4/hostpath-provisioner, container-native-virtualization/kubemacpool, container-native-virtualization/bridge-marker, container-native-virtualization/ovs-cni-marker, container-native-virtualization/ovs-cni-plugin, container-native-virtualization/kubevirt-vmware, +12 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat OpenStack Platform 16.2 osp-director-provisioner-container Red Hat Quay 3 quay/quay-rhel8, quay/clair-rhel8, quay/quay-builder-rhel8, quay/quay-operator-rhel8, quay/quay-openshift-bridge-rhel8-operator, quay/quay-container-security-operator-rhel8 Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more Red Hat Service Telemetry Framework 1.2 for RHEL 8 stf/sg-core-rhel8, smart-gateway-containeraffected: workaround, no fix available
-
Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-cdi-cloner v4.9.4-7, container-native-virtualization/virt-cdi-importer v4.9.4-7, container-native-virtualization/virt-cdi-operator v4.9.4-7, container-native-virtualization/virt-cdi-apiserver v4.9.4-7, container-native-virtualization/virt-cdi-controller v4.9.4-7, container-native-virtualization/virt-cdi-uploadproxy v4.9.4-7fixed: vendor fix RHEA-2022:1596
show 18 moreshow fewer
-
Red Hat CNV 4.12 for RHEL 7 kubevirt 4.12.0-1057.el7, kubevirt-virtctl 4.12.0-1057.el7, kubevirt-virtctl-redistributable 4.12.0-1057.el7 Red Hat CNV 4.12 for RHEL 8 kubevirt 4.12.0-1057.el8, kubevirt-virtctl 4.12.0-1057.el8, kubevirt-virtctl-redistributable 4.12.0-1057.el8, container-native-virtualization/virt-api v4.12.0-255, container-native-virtualization/virt-handler v4.12.0-255, container-native-virtualization/virt-launcher v4.12.0-255, +3 morefixed: vendor fix RHSA-2023:0407
-
Red Hat Cryostat 2 on RHEL 8 cryostat-20-tech-preview/cryostat-rhel8-operator 2.0.0-8, cryostat-20-tech-preview/cryostat-operator-bundle 2.0.0-6.1641316447fixed: vendor fix RHSA-2022:0163
-
Red Hat OpenShift Sandboxed Containers 1.2.0 openshift-sandboxed-containers/osc-rhel8-operator 1.2.0-14fixed: vendor fix RHSA-2022:0855
-
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.16 1.16.12-1.el7_9, go-toolset-1.16-build 1.16.12-1.el7_9, go-toolset-1.16-golang 1.16.12-1.el7_9, go-toolset-1.16-runtime 1.16.12-1.el7_9, go-toolset-1.16-scldevel 1.16.12-1.el7_9, go-toolset-1.16-golang-bin 1.16.12-1.el7_9, +4 morefixed: vendor fix RHSA-2021:5176
-
Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.9-5.el8_5, delve 1.6.0-1.module+el8.5.0+10379+d6b83bd0, golang 1.16.12-1.module+el8.5.0+13637+960c7771, go-toolset 1.16.12-1.module+el8.5.0+13637+960c7771, golang-bin 1.16.12-1.module+el8.5.0+13637+960c7771, golang-src 1.16.12-1.module+el8.5.0+13637+960c7771, +3 morefixed: vendor fix RHSA-2021:5160
-
Red Hat Enterprise Linux AppStream EUS (v.8.4) grafana 7.3.6-4.el8_4fixed: vendor fix RHSA-2022:0002
-
Red Hat Gluster 3.5 Web Administration on RHEL-7 etcd 3.3.23-9.el7rhgs, grafana 5.2.4-5.el7rhgsfixed: vendor fix RHSA-2022:1628
-
Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-velero-rhel8 v1.7.1-3fixed: vendor fix RHSA-2022:1734
-
Red Hat OpenShift Container Platform 4.9 butane 0.13.1-2.rhaos4.9.el8, ignition 2.12.0-3.rhaos4.9.el8, ignition-validate 2.12.0-3.rhaos4.9.el8, butane-redistributable 0.13.1-2.rhaos4.9.el8fixed: vendor fix RHSA-2022:0557
-
Red Hat OpenShift Container Platform 4.10 cri-o 1.23.1-9.rhaos4.10.gitbdffb9a.el8, cri-o 1.23.0-92.rhaos4.10.gitdaab4d1.el7, containernetworking-plugins 0.9.1-2.rhaos4.10.el8, openshift 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7, openshift 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8, openshift4/ose-cli v4.10.0-202202160843.p0.gf93da17.assembly.stream, +154 morefixed: vendor fix RHSA-2022:0055
-
Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.0.0-2.el8fixed: vendor fix RHSA-2022:1056
-
Red Hat OpenShift Serverless 1.21 openshift-serverless-1/client-kn-rhel8 1.0.0-2, openshift-serverless-1/serving-queue-rhel8 1.0.1-2, openshift-serverless-1/eventing-mtping-rhel8 1.0.0-4, openshift-serverless-1/kourier-control-rhel8 1.0.0-2, openshift-serverless-1/serving-webhook-rhel8 1.0.1-2, openshift-serverless-1/eventing-webhook-rhel8 1.0.0-4, +28 morefixed: vendor fix RHSA-2022:1051
-
Red Hat OpenStack Platform 16.1 etcd 3.3.23-7.el8ostfixed: vendor fix RHSA-2022:0260
-
Red Hat OpenStack Platform 16.2 etcd 3.3.23-7.el8ost, rhosp-rhel8-tech-preview/osp-director-operator 1.2.2-3, rhosp-rhel8-tech-preview/osp-director-downloader 1.2.2-2fixed: vendor fix RHSA-2022:0237
-
Red Hat RHODF 4.10 for RHEL 8 mcg 5.10.0-72.el8, odf4/cephcsi-rhel8 v4.10.0-35, odf4/mcg-core-rhel8 v4.10.0-12, mcg-redistributable 5.10.0-72.el8, odf4/odf-console-rhel8 v4.10.0-27, odf4/odf-topolvm-rhel8 v4.10.0-16, +20 morefixed: vendor fix RHSA-2022:1361
-
Red Hat Service Telemetry Framework 1.3 for RHEL 8 stf/sg-core-rhel8 4.0.4-1fixed: vendor fix RHSA-2022:0587
-
Red Hat Service Telemetry Framework 1.4 for RHEL 8 stf/sg-core-rhel8 4.1.1-2fixed: vendor fix RHSA-2022:0585
-
Red Hat CNV 4.9 for RHEL 8 container-native-virtualization/virt-api v4.9.4-7, container-native-virtualization/virtio-win v4.9.4-5, container-native-virtualization/kubemacpool v4.9.4-5, container-native-virtualization/virt-handler v4.9.4-7, container-native-virtualization/bridge-marker v4.9.4-5, container-native-virtualization/virt-launcher v4.9.4-7, +24 more Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virtio-win v4.12.0-10, container-native-virtualization/kubemacpool v4.12.0-24, container-native-virtualization/bridge-marker v4.12.0-24, container-native-virtualization/ovs-cni-marker v4.12.0-24, container-native-virtualization/ovs-cni-plugin v4.12.0-24, container-native-virtualization/virt-cdi-cloner v4.12.0-72, +31 more Red Hat OpenShift Sandboxed Containers 1.2.0 openshift-sandboxed-containers/osc-monitor-rhel8 1.2.0-9, openshift-sandboxed-containers/osc-operator-bundle 1.2.0-19, openshift-sandboxed-containers/osc-must-gather-rhel8 1.2.0-10 Red Hat Enterprise Linux 9 golang, grafana, go-toolset, golang-bin, golang-src, golang-misc, +3 more Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.1-6, rhmtc/openshift-velero-plugin-rhel8 v1.7.1-4, rhmtc/openshift-migration-openvpn-rhel8 v1.7.1-4, rhmtc/openshift-migration-registry-rhel8 v1.7.1-4, rhmtc/openshift-migration-rhel8-operator v1.7.1-11, rhmtc/openshift-migration-controller-rhel8 v1.7.1-7, +9 more Red Hat OpenShift Container Platform 4 podman, skopeo, buildah, cri-tools, podman-tests, skopeo-tests, +10 morenot affected: vulnerable code not present
+1 more productsfewer
Red Hat OpenShift Container Platform 4.9 cri-tools 1.22.0-2.el8, ovn21.12 21.12.0-25.el8fdp, ovn21.12-host 21.12.0-25.el8fdp, ovn21.12-vtep 21.12.0-25.el8fdp, ovn21.12-central 21.12.0-25.el8fdp, jenkins-2-plugins 4.9.1644822177-1.el8, +14 more
4 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-047-04 updated cvss 7.5
Siemens Brownfield Connectivity Gateway
-
Siemens Brownfield Connectivity - Gateway <V1.10affected: fixed in V1.11
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
4.25% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | golang.org/x/net/http2 | <0.0.0-20211209124913-491a49abca63 |
0.0.0-20211209124913-491a49abca63 |
| bitnami | golang | <1.16.12 >=1.17.0, <1.17.5 |
1.16.12 1.17.5 |
| go | stdlib | <1.16.12 >=1.17.0-0, <1.17.5 |
1.16.12 1.17.5 |
| go | golang.org/x/net | <0.0.0-20211209124913-491a49abca63 |
0.0.0-20211209124913-491a49abca63 |
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
groups.google.com
/g/golang-announce/c/hcmEScgc00k
web, mailing-list, patch, vendor-advisory, advisory
-
go.dev
/cl/369794
web, patch
-
security.gentoo.org
/glsa/202208-02
vendor-advisory, web, third-party-advisory, advisory
-
security.netapp.com
/advisory/ntap-20220121-0002/
third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2022/01/msg00016.html
mailing-list, web, third-party-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2022/01/msg00017.html
mailing-list, web, third-party-advisory, advisory
- cert-portal.siemens.com /productcert/pdf/ssa-744259.pdf
-
lists.debian.org
/debian-lts-announce/2023/04/msg00021.html
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2021-44716
advisory, web
-
go.dev
/issue/50058
web, report
-
pkg.go.dev
/vuln/GO-2022-0288
web
-
security.netapp.com
/advisory/ntap-20220121-0002
web
Sources
- CVE List CVE-2021-44716
- GitHub Advisory GHSA-vc3p-29h2-gpcp
- NVD CVE-2021-44716
- OSV BIT-golang-2021-44716
- OSV GO-2022-0288
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.