golang.org/x/net vulnerable to Uncontrolled Resource Consumption (CVE-2022-41723)

golang.org/x/net vulnerable to Uncontrolled Resource Consumption (CVE-2022-41723) | HOL Guard CVE

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps golang.org/x/net (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
golang.org/x/netgo	>=0 <0.7.0	0.7.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for golang.org/x/net.
Review the reported fix. Update golang.org/x/net to 0.7.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Feb 17, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Quoted source text, attributed separately from HOL analysis.