{"id":"UBUNTU-CVE-2021-44716","details":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.","modified":"2026-06-23T00:30:08.951982386Z","published":"2022-01-01T05:15:00Z","upstream":["CVE-2021-44716"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-44716"},{"type":"REPORT","url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k/m/ZWnOjeY4CQAJ"},{"type":"REPORT","url":"https://github.com/golang/go/commit/48d948963c5ce7add72af5665a871caff6c1d35a"},{"type":"REPORT","url":"https://github.com/golang/net/commit/491a49abca63de5e07ef554052d180a1b5fe2d70"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-44716"}],"affected":[{"package":{"name":"golang-golang-x-net-dev","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/golang-golang-x-net-dev?arch=source&distro=esm-infra%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0+git20150226.3d87fd6-3","0.0+git20151007.b846920+dfsg-1","1:0.0+git20150817.66f0418-1","1:0.0+git20160110.4fd4a9f-1","1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1","1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2"],"ecosystem_specific":{"binaries":[{"binary_version":"1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2","binary_name":"golang-go.net-dev"},{"binary_version":"1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2","binary_name":"golang-golang-x-net-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"google-guest-agent","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/google-guest-agent?arch=source&distro=esm-apps-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1","20240716.00-0ubuntu1~16.04.0+esm2","20240716.00-0ubuntu1~16.04.0+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"google-guest-agent","binary_version":"20240716.00-0ubuntu1~16.04.0+esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"golang-1.8","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/golang-1.8?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.8.3-2ubuntu1.18.04.1","binary_name":"golang-1.8"},{"binary_name":"golang-1.8-go","binary_version":"1.8.3-2ubuntu1.18.04.1"},{"binary_version":"1.8.3-2ubuntu1.18.04.1","binary_name":"golang-1.8-go-shared-dev"},{"binary_version":"1.8.3-2ubuntu1.18.04.1","binary_name":"golang-1.8-src"},{"binary_version":"1.8.3-2ubuntu1.18.04.1","binary_name":"libgolang-1.8-std1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"golang-golang-x-net-dev","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/golang-golang-x-net-dev?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20170629.c81e7f2+dfsg-1ubuntu1","1:0.0+git20170629.c81e7f2+dfsg-1ubuntu2","1:0.0+git20170629.c81e7f2+dfsg-2","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2","1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3"],"ecosystem_specific":{"binaries":[{"binary_version":"1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3","binary_name":"golang-go.net-dev"},{"binary_version":"1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3","binary_name":"golang-golang-x-net-dev"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"google-guest-agent","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/google-guest-agent?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0+esm1","20241011.01-0ubuntu1~18.04.0+esm2","20241011.01-0ubuntu1~18.04.0+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"google-guest-agent","binary_version":"20241011.01-0ubuntu1~18.04.0+esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"google-guest-agent","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/google-guest-agent?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231004.02-0ubuntu1~20.04.3"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2"],"ecosystem_specific":{"binaries":[{"binary_name":"google-guest-agent","binary_version":"20231004.02-0ubuntu1~20.04.3"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"golang-golang-x-net-dev","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/golang-golang-x-net-dev?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0+git20190811.74dc4d7+dfsg-1","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2","1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3"],"ecosystem_specific":{"binaries":[{"binary_version":"1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3","binary_name":"golang-go.net-dev"},{"binary_name":"golang-golang-x-net-dev","binary_version":"1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"golang-1.17","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/golang-1.17?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"],"ecosystem_specific":{"binaries":[{"binary_version":"1.17.13-3ubuntu1.3","binary_name":"golang-1.17"},{"binary_name":"golang-1.17-go","binary_version":"1.17.13-3ubuntu1.3"},{"binary_name":"golang-1.17-src","binary_version":"1.17.13-3ubuntu1.3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}},{"package":{"name":"google-guest-agent","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/google-guest-agent?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231004.02-0ubuntu1~22.04.3"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2"],"ecosystem_specific":{"binaries":[{"binary_version":"20231004.02-0ubuntu1~22.04.3","binary_name":"google-guest-agent"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44716.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}