Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 3 products
We just ran Qualys’ AI agent against a legacy Apache on port 80 with mis-configured mod_ssl; it auto-exploited CVE-2022-41717 in our sandbox, patched the cipher suite and hardened TLS. https://x.com/i/status/2037102343070814393
Post summary
Qualys’ AI agent automatically exploited CVE‑2022‑41717 in a sandboxed Apache instance, after which the team mitigated the vulnerability by patching cipher suites and hardening TLS.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | fedoraproject | fedora | 37 | - | - |
| OS | fedoraproject | fedora | 38 | - | - |
| App | golang | go | - | - | - |
| App | golang | http2 | - | go | - |