The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 20, 2017 | Aug 14, 2015 |
| Centos_linux | — | Upgrade golang-srcUpgrade golang-miscUpgrade golang-testsUpgrade golang-docsUpgrade golang-binUpgrade golang | Oct 19, 2017 | Aug 24, 2015 |
| Freebsd | — | Upgrade goUpgrade go14 | Dec 10, 2025 | Aug 25, 2015 |
| Redhat_linux | — | Upgrade golang-binUpgrade golang-docsUpgrade golang-miscUpgrade golang-testsUpgrade golangUpgrade golang-src | Oct 21, 2016 | Aug 24, 2015 |
| Suse | — | Upgrade go-debugsourceUpgrade go-debuginfoUpgrade goUpgrade go-doc | Jul 28, 2016 | Aug 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub