golang.org/x/net/http2 Denial of Service vulnerability (CVE-2022-27664)

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps golang.org/x/net (go), golang.org/x/net/http2 (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
golang.org/x/netgo	>=0 <0.0.0-20220906165146-f3363e06e74c	0.0.0-20220906165146-f3363e06e74c
golang.org/x/net/http2go	>=0 <0.0.0-20220906165146-f3363e06e74c	0.0.0-20220906165146-f3363e06e74c

Recommended response

Check inventory. Check lockfiles and deployed manifests for golang.org/x/net, golang.org/x/net/http2.
Review the reported fix. Update golang.org/x/net to 0.0.0-20220906165146-f3363e06e74c; golang.org/x/net/http2 to 0.0.0-20220906165146-f3363e06e74c if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 7, 2022
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Quoted source text, attributed separately from HOL analysis.