CVE-2022-41721
HighAdvisory
Published 13 Jan 2023In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.018
- 77th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 158
- of 17,781 indexed, latest versions
- Container images
- 157
- deployed by those charts
- Fix available
- 1 of 1
- affected package
golang.org/x/net/http2/h2c vulnerable to request smuggling attack
Carried by container images the latest versions of 158 of 17,781 indexed charts deploy, on 157 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| golang.org/ | v0.0.0-20220524220425-1d687d428aca, v0.0.0-20220526153639-5463443f8c37, v0.0.0-20220531201128-c960675eff93, v0.0.0-20220607020251-c690dde0001d+30 more | 0.1.1-0.20221104162952-702349b0e862 | 157 |
- OSV records
- GHSA-fxg5-wq6x-vr4w
- Also known as
- GO-2023-1495
Charts affected
158 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| gitlab-runnerslamdev | 0.0.1 | 1 of 1See more | 9,196 |
| sealed-secretssoftonic | 2.6.9 | 1 of 1See more | 1,515 |
| argocd-operatorstatcan | 0.5.0 | 1 of 1See more | 1,985 |
| aws-eks-asg-rolling-update-handlertwin | 1.5.0 | 1 of 1See more | 1,118 |
| miniouninettsigma2 | 1.2.0 | 1 of 1See more | 4,960 |
| vineyard-operatorvineyardVerified publisher | 0.24.2 | 1 of 2See more | 4,525 |
| openebswenerme | 3.10.0 | 2 of 3See more | 10,489 |
| csi-driver-host-pathwiremindVerified publisher | 0.1.1 | 7 of 8See more | 12,606 |
Container images carrying it
157 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 2ad610626658 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 6 |
| registry.k8s.io/ | 4d99688e5573 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 4 |
| bitnamilegacy/ | 016dce036593 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 3 |
| ciscolabs/ | b59fc10bb821 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 3 |
| groundnuty/ | c14d7271e401 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 3 |
| public.ecr.aws/ | fefa9ee7256a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 3 |
| quay.io/ | 48cdd3054b20 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 3 |
| registry.k8s.io/ | 4ba73c697770 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 3 |
| bitnamilegacy/ | d17df1f9d745 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| grafana/ | 057896e23443 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| hashicorp/ | e38576edcdfd | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| hashicorp/ | 8de4d5f31b38 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| hashicorp/ | 844337076b72 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| iomesh/ | 560f01510f99 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| lachlanevenson/ | af5cea3f2e40 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| library/ | 44a366dd7724 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| openebs/ | f6c18b0f8c8a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| openebs/ | 6afe2123c457 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| rancher/ | 9380f5dbae9a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| ribbybibby/ | 718abe7f5e79 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| ghcr.io/ | 56f8617363b4 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| ghcr.io/ | cf4428a3c79e | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| quay.io/ | 738c854322f5 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| quay.io/ | 8c65b333a3d3 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| registry.k8s.io/ | a15ca437f230 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| registry.k8s.io/ | 9a685020911e | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| registry.k8s.io/ | f1c25991bac2 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| registry.k8s.io/ | cacee2b5c36d | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 2 |
| altinity/ | 8f0f582d41f0 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| altinity/ | 1a46d104406d | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| apecloud/ | dbca95a15bc1 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| aquasec/ | 973d0df16189 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| assistiot/ | 30812ba93555 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| bicarus/ | b1dab0721e1c | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| bitnamilegacy/ | 3bb1deeaf9d0 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| bitnamilegacy/ | 3c26208691a1 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| bitnami/ | 0516f987fae2 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| breton/ | 41b1bb483aa2 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| chirpstack/ | fb7667fe037f | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| csepulvedab/ | 227a6f2b0ff8 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| datappeal/ | 6b5b9fdb2e6d | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| deepflowce/ | 6b51a0206b04 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| dellemc/ | 148ada9060a9 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| easysoft/ | 592ad5df1f8b | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| elastic/ | c7a1c63257d0 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| emqx/ | 53865c1267d9 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| epamedp/ | 924939850655 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ethereum/ | cce21b423165 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| ethpandaops/ | d1780db2e286 | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |
| falcosecurity/ | 828ee36cb13a | golang.org/ | 0.1.1-0.20221104162952-702349b0e862 | 1 |