Wind River Support Network

HomeDefectsLIN1021-5074

Fixed

LIN1021-5074 : Security Advisory - go - CVE-2022-41721

Created: Jan 18, 2023 Updated: Jun 13, 2025

Resolved Date: Jun 13, 2025

Found In Version: 10.21.20.1

Severity: Standard

Applicable for: Wind River Linux LTS 21

Component/s: Userspace

Description

Golang: A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

CREATE(Triage):(User=admin) CVE-2022-41721 (https://nvd.nist.gov/vuln/detail/CVE-2022-41721)