The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 20, 2017 | Aug 14, 2015 |
| Centos_linux | — | Upgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golangUpgrade golang-miscUpgrade golang-tests | Oct 19, 2017 | Aug 24, 2015 |
| Freebsd | — | Upgrade go14Upgrade go | Dec 10, 2025 | Aug 25, 2015 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-docs | Oct 21, 2016 | Aug 24, 2015 |
| Suse | — | Upgrade go-docUpgrade go-debuginfoUpgrade goUpgrade go-debugsource | Jul 28, 2016 | Aug 24, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub