CVE-2022-41721High· 7.5▾ TwilightA request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead read the b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
1.8%
Last analysed / modified upstream
1.8% → 1.8%
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead read the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
x/net/http2/h2c: request smuggling — rated Moderate by Red Hat. Released 2022-01-01, updated 2026-09-17.
Affected:
Fixed:
No fix planned:
Not affected:
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags
The sha values for the release are:
(For x8… https://access.redhat.com/errata/RHSA-2023:1326 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:4627
Affected packages:
golang.org/x/net >= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862Patched in:
golang.org/x/net 0.1.1-0.20221104162952-702349b0e862Connected by shared product, vendor, weakness, or advisory.
CVE-2025-53643Low· 3.7aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
CVE-2024-52304Medium· 5.9aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304)
CVE-2026-61642High· 7.7Squid is a caching proxy for the Web
CVE-2026-103399Medium· 5.3A flaw was found in SoupServer (libsoup)
CVE-2026-14180Medium· 5.3A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding
CVE-2026-37236Critical· 9.8grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control