modules:
  - module: std
    versions:
      - fixed: 1.19.6
      - introduced: 1.20.0
        fixed: 1.20.1
    vulnerable_at: 1.20.0
    packages:
      - package: net/http
  - module: golang.org/x/net
    versions:
      - fixed: 0.7.0
    vulnerable_at: 0.6.1-0.20230213185550-547e7edf3873
    packages:
      - package: golang.org/x/net/http2
      - package: golang.org/x/net/http2/hpack
        symbols:
          - Decoder.parseFieldLiteral
          - Decoder.readString
        derived_symbols:
          - Decoder.DecodeFull
          - Decoder.Write
description: |
    A maliciously crafted HTTP/2 stream could cause excessive CPU consumption
    in the HPACK decoder, sufficient to cause a denial of service from a small
    number of small requests.
ghsas:
  - GHSA-vvpx-j8f3-3w6h
credit: Philippe Antoine (Catena cyber)
references:
  - report: https://go.dev/issue/57855
  - fix: https://go.dev/cl/468135
  - fix: https://go.dev/cl/468295
  - web: https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
cve_metadata:
    id: CVE-2022-41723
    cwe: 'CWE 400: Uncontrolled Resource Consumption'