CVE-2022-41721
HighAdvisory
Published 13 Jan 2023In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.018
- 77th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 158
- of 17,781 indexed, latest versions
- Container images
- 157
- deployed by those charts
- Fix available
- 1 of 1
- affected package
golang.org/x/net/http2/h2c vulnerable to request smuggling attack
Carried by container images the latest versions of 158 of 17,781 indexed charts deploy, on 157 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| golang.org/ | v0.0.0-20220524220425-1d687d428aca, v0.0.0-20220526153639-5463443f8c37, v0.0.0-20220531201128-c960675eff93, v0.0.0-20220607020251-c690dde0001d+30 more | 0.1.1-0.20221104162952-702349b0e862 | 157 |
- OSV records
- GHSA-fxg5-wq6x-vr4w
- Also known as
- GO-2023-1495
Charts affected
158 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| gitlab-runnerslamdev | 0.0.1 | 1 of 1See more | 9,196 |
| sealed-secretssoftonic | 2.6.9 | 1 of 1See more | 1,515 |
| argocd-operatorstatcan | 0.5.0 | 1 of 1See more | 1,985 |
| aws-eks-asg-rolling-update-handlertwin | 1.5.0 | 1 of 1See more | 1,118 |
| miniouninettsigma2 | 1.2.0 | 1 of 1See more | 4,960 |
| vineyard-operatorvineyardVerified publisher | 0.24.2 | 1 of 2See more | 4,525 |
| openebswenerme | 3.10.0 | 2 of 3See more | 10,489 |
| csi-driver-host-pathwiremindVerified publisher | 0.1.1 | 7 of 8See more | 12,606 |
Container images carrying it
157 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 448cb346b12c | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 700bb42ac21d | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 4dd365800b62 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 13964b29d63e | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | d3de52dfb0b4 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | b803fbe1cdb8 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | c298183a5208 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 94c9a3e799c2 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | ebd03028ff6a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 455f6e7a26fd | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | f52e66eff50b | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | aa0c8526ae5e | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | a1d4cf8b8fe1 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | e3d1f1302e49 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | ac8459f70f85 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | af77073c184f | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 313edfec2fca | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 3267d27d392f | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 2d522b664e12 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | cdc0658c40fb | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | f4324baa2aad | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 22f84e3615c8 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 91fca773a63f | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | 89969b78fb07 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | bf816072380e | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | d7bdfa7b41da | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | ce1862e6b3a5 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ghcr.io/ | a2523c532c0c | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| mcr.microsoft.com/ | bccaa701e2df | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| public.ecr.aws/ | 363bd65cd707 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| public.ecr.aws/ | f0e5ab60b2df | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 5b6701d8fb31 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | cf8faa986789 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 5efd991d218b | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 4ab8e6604204 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 13aaae779248 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 0cca71497e9e | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | b5657161d2c2 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 1143471c90db | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 64121721c665 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 50ee58bc9770 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 546a8b52d7b0 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | c3d20bc2ea08 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | d853057f2800 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | f0c5bebaec96 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 4748e26f9369 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| quay.io/ | 56e7f18e05dd | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| registry.gitlab.com/ | 826b984e75d4 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| registry.k8s.io/ | 54f7fe2c6c5a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| registry.k8s.io/ | f6902791fb9a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |