Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

resolve CVE-2022-27664 #1377

merged 1 commit into from Sep 15, 2022


Copy link

@cbodonnell cbodonnell commented Sep 14, 2022

This PR updates the dependency to resolve CVE-2022-27664.

Trivy scan showing this vulnerability trivy fs --ignore-unfixed --severity CRITICAL,HIGH .:

go.mod (gomod)

Total: 2 (HIGH: 2, CRITICAL: 0)

│       Library       │ Vulnerability  │ Severity │         Installed Version         │           Fixed Version           │                            Title                            │
│ │ CVE-2022-27191 │ HIGH     │ 0.0.0-20220214200702-86341886e292 │ 0.0.0-20220314234659-1baeb1ce4c0b │ golang: crash in a server           │
│                     │                │          │                                   │                                   │                  │
├─────────────────────┼────────────────┤          ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│    │ CVE-2022-27664 │          │ 0.0.0-20220225172249-27dd8689420f │ 0.0.0-20220906165146-f3363e06e74c │ golang: net/http: handle server errors after sending GOAWAY │
│                     │                │          │                                   │                                   │                  │

I didn't update since it only seems relevant to the server.

@cbodonnell cbodonnell changed the title resolve CVE-2022-27191 and CVE-2022-27664 resolve CVE-2022-27664 Sep 14, 2022
Copy link

This CVE is completely irrelevant for fasthttp as we don't use the http2 code from But it can't hurt to update our dependencies so I'll merge it anyways.

@erikdubbelboer erikdubbelboer merged commit 31fdc79 into valyala:master Sep 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

Successfully merging this pull request may close these issues.

None yet

2 participants