CVE-2022-41723: Golang Go

High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days.

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Affected products

• Golang Go: before 1.19.6 (fixed in 1.19.6); version 1.20.0 only
• Golang Hpack: before 0.7.0 (fixed in 0.7.0)
• Golang HTTP2: before 0.7.0 (fixed in 0.7.0)

Published 2023-02-28. Last modified 2026-06-17.