CVE-2021-44716: Debian Linux

High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days.

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Affected products

• Debian Debian Linux: version 9.0 only
• Golang Go: before 1.16.12 (fixed in 1.16.12); from 1.17.0, before 1.17.5 (fixed in 1.17.5)
• Netapp Cloud Insights Telegraf: affected versions not specified

Published 2022-01-01. Last modified 2026-06-17.