The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 20, 2017 | Aug 14, 2015 |
| Centos_linux | — | Upgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-miscUpgrade golang-src | Oct 19, 2017 | Aug 24, 2015 |
| Freebsd | — | Upgrade go14Upgrade go | Dec 10, 2025 | Aug 25, 2015 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golangUpgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang-src | Oct 21, 2016 | Aug 24, 2015 |
| Suse | — | Upgrade goUpgrade go-debuginfoUpgrade go-docUpgrade go-debugsource | Jul 28, 2016 | Aug 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub