CVE-2022-41721High· 7.5▾ TwilightA request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead read the b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
1.8%
Last analysed / modified upstream
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead read the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
x/net/http2/h2c: request smuggling — rated Moderate by Red Hat. Released 2022-01-01, updated 2026-09-17.
Affected:
Fixed:
No fix planned:
Not affected:
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags
The sha values for the release are:
(For x8… https://access.redhat.com/errata/RHSA-2023:1326 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:4627
Affected packages:
golang.org/x/net >= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862Patched in:
golang.org/x/net 0.1.1-0.20221104162952-702349b0e862Connected by shared product, vendor, weakness, or advisory.
CVE-2026-6993Medium· 5.3go-kratos: go-kratos kratos: Information disclosure via unintended HTTP server intermediary (CVE-2026-6993)
CVE-2026-69243High· 7.0AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-93574Medium· 6.5A flaw was found in Netty's `netty-codec-http` component
CVE-2026-93573Medium· 6.5A flaw was found in Netty's HTTP/1.1 decoder
CVE-2026-93569High· 8.2A flaw was found in Netty
CVE-2026-90678High· 7.5An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5